Add Security Warning for HTML Encoding

By default the table option escape is set to false, which means any data by a potential attacker will end up unencoded in the DOM, which might make the table susceptible to Cross-Site Scripting attacks and others.

In my opinion the default should be set to true, even though this is a breaking change, in order to mitigate the potential vulnerability. At the very least, a security warning should be added in order to inform people of the potential security risk, if the behavior should not be changed.

The same applies to formatters, even though the issue is even more complicated here, as data passed to a formatter doesn’t have to be a string, which could be easily encoded depending on escape, instead it could be an object or an array. I would appreciate to have a security warning here as well, in order to inform people, that any user input put into the HTML string will end up unencoded in the table and could lead to a Cross-Site Scripting vulnerability.

This has been discussed in various issues before, but I feel like this would add some additional awareness.

[wenzhixin]

Maybe we can add a file, for example, bootstrap-table-security.js:

window.jQuery.extend(window.jQuery.fn.bootstrapTable.defaults, {
  escape: true
})

window.jQuery.extend(window.jQuery.fn.bootstrapTable.columnDefaults, {
  escape: true
})

What do you think?

[UtechtDustin]

I also dont like the idea with a new file. This should be part of the bootstrap table, either as option or as default value (which makes more sense i guess).