fix: BROS-664: Fix XSS via script injection in custom hotkeys

label_studio/core/templatetags/filters.py

@@ -127,3 +127,16 @@ def var_exists(context, name):
             if name in d:
                 return True
     return False
+
+
+@register.filter
+def replace(value, arg):
+    """
+    Replacing filter
+    Use `{{ "aaa"|replace:"a|b" }}`
+    """
+    if len(arg.split('|')) != 2:
+        return value
+
+    what, to = arg.split('|')
+    return value.replace(what, to)

label_studio/templates/base.html

@@ -101,8 +101,7 @@
 </template>
 
 <script id="app-settings" nonce="{{request.csp_nonce}}">
-
-  var __customHotkeys = {{ user.custom_hotkeys|json_dumps_ensure_ascii|safe }};
+  var __customHotkeys = {{ user.custom_hotkeys|json_dumps_ensure_ascii|replace:"<|&lt;"|replace:">|&gt;"|safe }};
 
   // Filter custom hotkeys for editor-specific ones
   var editorCustomHotkeys = {};