Unjust XSS notice in the backend editor

[enovision]

Warning:

NOTICE: Grav found potential XSS issues in content: 'invalid_protocols'

on:

### Validation

The API performs two types of validation on submitted data:

but not on:

### Validation

The API performs two types of validation on submitted dataaaa:

It seems that data: is seen as XSS potential.

[rhukster]

Yup, data URLs are often used in XSS attacks: https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet

They can be used in a variety of different ways, so it's not easy to write a regex to catch only the problematic methods, so the regex simply searches for data:.

However, I could add an option to configure the protocols: https://github.com/getgrav/grav/blob/develop/system/src/Grav/Common/Security.php#L132

For now, this is just a warning if you are a super admin.

[lisandi]

Grav found potential XSS issues in %s

We receive that in the backend but what is %s??

[mkocus]

We've got the same warning as @lisandi.
"%s" should be supplemented by some string (probably with explanation what has been found) - but it is not.

[mahagr]

Fixed %s for the next version.