XSS vulnerability with the Quill field

[pakal]

Hello,

it seems no operation is done, on form submission or on access to quill.html, to ensure that the HTML tags of the quill field are secure and correspond to the allowed tags of the JS widget.

So anybody with access to a form can inject harmful content (<script> tags, javascript: urls) into the database data, which would then be executed client-side if he user has "marked safe" the quill content.

Sanitizing (e.g. with Bleach) would be required on input or output to prevent this.

If sanitizing is out-of-scope of this module, maybe a big Warning in the docs and readme would be useful instead ?

[LeeHanYeong]

Since I focused on implementation, this project is actually vulnerable to XSS attacks.
I added that to the README. Thanks.
62e14f6