dispenser: add input validation

[algolucky]

Summary

• adds some input validation to dispenser,
  • by first sanitizing the string to encode HTML tags
  • then a quick regular expression test to make sure it's at least something that resembles a wallet/address
• moves the template to a separate file and embeds it instead
• does some encoding on the server side to strip out any HTML tags
• updates onload to use text() instead of html()

References

• https://stackoverflow.com/a/12034334
• https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html#output-encoding

[codecov]

Codecov Report

Merging #4713 (456f0d9) into master (ab87a8a) will decrease coverage by 0.05%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master    #4713      +/-   ##
==========================================
- Coverage   54.49%   54.44%   -0.06%     
==========================================
  Files         407      407              
  Lines       52425    52425              
==========================================
- Hits        28569    28542      -27     
- Misses      21472    21492      +20     
- Partials     2384     2391       +7     

Impacted Files	Coverage Δ
ledger/voters.go	68.65% <0.00%> (-4.48%)	⬇️
network/wsPeer.go	66.50% <0.00%> (-2.67%)	⬇️
crypto/merkletrie/trie.go	66.42% <0.00%> (-2.19%)	⬇️
crypto/merkletrie/node.go	91.62% <0.00%> (-1.87%)	⬇️
ledger/catchpointtracker.go	61.84% <0.00%> (-1.05%)	⬇️
ledger/acctonline.go	77.60% <0.00%> (-0.53%)	⬇️
ledger/accountdb.go	72.69% <0.00%> (-0.32%)	⬇️
network/wsNetwork.go	65.52% <0.00%> (ø)
ledger/testing/randomAccounts.go	56.21% <0.00%> (ø)
ledger/acctupdates.go	69.89% <0.00%> (+0.29%)	⬆️
... and 4 more

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[excalq]

For the curious: https://github.com/algorand/js-algorand-sdk/blob/master/src/encoding/address.ts#L10

[excalq]

Good on you for pulling this HTML template out of the server side code.

[algolucky]

@excalq I mainly did it because it didn't like embeded backticks, but it's also cleaner.