Escape the name of labels and milestones

When we create usernames we escape the HTML because there isn't a situation where one is supposed to render the HTML of a username.

There are not any situations where we want to render the actual label titles or the milestone titles as HTML. If someone named a label

The <b>BESTEST</b> label

We wouldn't that to be rendered as

The BESTEST label

anywhere.

I am 99% sure we don't want the labels and milestone descriptions rendered as HTML. If they are supposed to be HTML why not use markdown. Which also allows HTML.

It seems inconsistent to allow limited HTML in some places and markdown in others.

cc @rspeicher @DouweM @JobV @dzaporozhets

Markdown is a superset of HTML: <b>Bold!</b> renders as Bold!

We sanitize the output based on a whitelist of tags and attributes, so wherever we allow Markdown, we also allow users to write HTML, but not any more HTML than we already would've allowed in Markdown.

Why would we support The *BESTEST* label but not The <b>BESTEST</b> label? Or am I misunderstanding you?

@DouweM Forget that for a moment and we should just say: "Let's make label and milestone titles safe" Because they were never meant to have any renderable HTML. Let's start there.

@DouweM @jschatz1 I agree that milestone and label title should be plain text. Probably we want to sanitize it on create/edit.

@jschatz1 Could you please specify where you encountered this problem? Im trying to reproduce the problem, and code wise it looks like we sanitise already?

@zj Now we sanitize it in the JS with _.escape. But it should be sanitized on the Ruby side before it gets to JS.

Reassigned to @felipe_artur

mentioned in merge request !4046 (merged)

Status changed to closed by commit 0c2bb8d1

mentioned in commit 0c2bb8d1