feat: prevent special characters from url

packages/x-components/src/x-modules/url/components/url-handler.vue

@@ -165,6 +165,27 @@
       this.urlLoaded = true;
     }
 
+    /**
+     * Detects if the user typing or pasting special/forbidden characters in some URL param.
+     *
+     * @internal
+     * @param urlValue - Param from the url that will be checked for special characters.
+     * @returns Param without special characters.
+     */
+    protected hasSpecialKeys(urlValue: string): string {
+      if (/[<>]/.test(urlValue ?? '')) {
+        let value = urlValue.replace(/<.*>/g, '');
+        if (!/</.test(value ?? '')) {
+          value = value.replace(/.*>/g, '');
+        } else if (!/>/.test(value ?? '')) {
+          value = value.replace(/<.*/g, '');
+        }
+        return value;
+      } else {
+        return urlValue;
+      }
+    }
+
     /**
      * Creates the wire metadata to include in every emitted {@link XEvent}.
      *
@@ -255,10 +276,13 @@
           const urlKey = this.getUrlKey(name);
           if (urlSearchParams.has(urlKey)) {
             if (name in initialUrlState) {
-              const urlValue = urlSearchParams.getAll(urlKey);
+              let urlValue = urlSearchParams.getAll(urlKey);
+              urlValue[0] = this.hasSpecialKeys(urlValue[0]);
               params.all[name] = this.parseUrlParam(name, urlValue);
             } else {
-              params.all[name] = params.extra[name] = urlSearchParams.get(urlKey);
+              let urlValueExtra = urlSearchParams.get(urlKey);
+              urlValueExtra = this.hasSpecialKeys(urlValueExtra!);
+              params.all[name] = params.extra[name] = urlValueExtra;
             }
           }
           return params;