[Bug] Pasted blocks are not sanitized, It may occurs XSS attack!

[hata6502]

Describe a bug.
Pasted blocks are not sanitized, It may occurs XSS attack!

Steps to reproduce:

1. Copy blocks includes <b onclick="alert('XSS test')">Click me!</b>
2. Paste blocks.
3. Click it.

Please see the following GIF animation.

Expected behavior:
Pasted blocks should be sanitized.

Screenshots:

Editor.js version: v2.19.0

[gurshafriri]

👋 @gohabereg @neSpecc did you have a chance to follow up on this issue?
We (at snyk) would like to add it to our vulnerability db if it is valid.

[neSpecc]

Actually, it will be sanitised on saving, so this is not a real vulnerability. But we will think about it.

[hata6502]

@neSpecc Thank you! I'll fix it and send PR.