security: fix stored XSS in activities and notes rendering

[bhavesh-018]

Issue Reference

Fix #2419

Description

This pull request mitigates a Stored Cross-Site Scripting (CWE-79) vulnerability in the Activities module.

User-controlled input in activity comments was previously rendered using dynamic HTML injection (v-html / v-safe-html), allowing execution of malicious JavaScript.

Changes made:

• Replaced v-html usage in datagrid table rendering.
• Replaced v-safe-html in activity timeline rendering.
• Ensured activity comments are rendered using escaped Vue interpolation.
• Standardized safe rendering across activities and notes views.

User-supplied content is now displayed as plain text, preventing script execution.

How To Test This?

1. Log in as any authenticated user.
2. Navigate to Contacts → Persons.
3. Open any record and add a Note.
4. Insert the following payload:
   <script>alert('XSS')</script>
5. Save the note.
6. Refresh the page or view as another user.

Expected Result:

• The script does not execute.
• The content is displayed as plain text.
• No alert popup appears.
• No layout breakage occurs.

Documentation

• My pull request requires an update on the documentation repository.

Branch Selection

• Target Branch: master

Tailwind Reordering

All Tailwind classes remain unchanged except for rendering adjustments.

[Dineshrajansv]

Hi @bhavesh-018 ,

Thank you for implementing the fix for this issue (#2419).

The changes look good, especially the removal of unsafe rendering (v-html / v-safe-html) and the shift to escaped output.

I’ll validate the fix from my side once it is merged or if a test instance is available.

Please feel free to let me know if any additional testing or verification is required.

Also, I would appreciate being credited in the security advisory or release notes for reporting this vulnerability.

Thanks again for the quick turnaround.

Best regards,
Dinesh Rajan S V

[bhavesh-018]

Hi @Dineshrajansv
Thank you for reviewing the fix and for reporting the issue.
Appreciate your validation support. Regarding advisory credits, that would be handled by the maintainers during the release process.

Thanks again for the detailed report and collaboration.

[Kgan0509]

@Dineshrajansv
Previously, this project used to assign CVEs for reported vulnerabilities. However, it appears that this is no longer the case, even my earlier reports were not assigned a CVE. If the issue has already been fixed and a CVE is not being issued anymore, you may consider publishing a technical write-up on your own blog to document your findings.

[Dineshrajansv]

Hi @bhavesh-018,

I validated the patch locally using the same payload:

<script>alert('XSS')</script>

The script is now rendered as plain text and no JavaScript execution occurs.
The fix successfully prevents the stored XSS.

Thanks for addressing the issue.

Best regards,
Dinesh Rajan S V