AAE-42904 Escape html in evaluated fields and variables for rich-text display widget (#11718)

lib/process-services-cloud/src/lib/form/components/widgets/display-rich-text/display-rich-text.widget.spec.ts

@@ -137,13 +137,15 @@ describe('DisplayRichTextWidgetComponent', () => {
     });
 
     it('should sanitize unsafe HTML', async () => {
+        mockRichTextParserService.parse.and.returnValue('<img src="x" onerror="alert(\'XSS\')">');
         widget.field = mockUnsafeFormField;
 
         fixture.detectChanges();
         await fixture.whenStable();
 
         const parsedHtmlEl = debugEl.query(By.css(cssSelector.parsedHTML));
-        expect(parsedHtmlEl.nativeElement.innerHTML.includes('<img src="x" onerror="alert(\'XSS\')">')).toBe(false);
+        expect(parsedHtmlEl.nativeElement.innerHTML.includes('img src="x"')).toBe(true);
+        expect(parsedHtmlEl.nativeElement.innerHTML.includes('onerror')).toBe(false);
     });
 
     describe('expression evaluation', () => {

lib/process-services-cloud/src/lib/form/components/widgets/display-rich-text/display-rich-text.widget.ts

@@ -90,7 +90,7 @@ export class DisplayRichTextWidgetComponent extends BaseDisplayTextWidgetCompone
 
     private applyExpressionsToBlocks(value: any): void {
         for (const block of value.blocks) {
-            block.data.text = this.resolveExpressions(block.data.text);
+            block.data.text = this.resolveExpressions(block.data.text, true);
         }
         this.field.value = value;
     }