[Backport] Prevent XSS on checkout

[dmytro-ch]

Original Pull Request

#18487

Description

The State/Province field (when selecting a country like The Netherlands) gives the user an input field (in checkout/account address). When filling <script>alert('hello world')</script>, the user will experience self xss in the next step of the checkout.

Fixed Issues (if relevant)

Bugcrowd reference cd8d0c3b57686f09cde51c4afaa2f0e70e51f9093121fb7140e3b7f26a89b7fd (which got marked as "won't fix")

Manual testing scenarios

See description/ (bugcrowd for video)

Contribution checklist

• Pull request has a meaningful description of its purpose
• All commits are accompanied by meaningful commit messages
• All new or changed code is covered with unit/integration tests (if applicable)
• All automated tests passed successfully (all builds on Travis CI are green)

[magento-engcom-team]

Hi @dmytro-ch. Thank you for your contribution
Here is some useful tips how you can test your changes using Magento test environment.
Add the comment under your pull request to deploy test or vanilla Magento instance:

• @magento-engcom-team give me test instance - deploy test instance based on PR changes
• @magento-engcom-team give me $VERSION instance - deploy vanilla Magento instance

For more details, please, review the Magento Contributor Assistant documentation

[magento-engcom-team]

Hi @sidolov, thank you for the review.
ENGCOM-3182 has been created to process this Pull Request

[magento-engcom-team]

Hi @dmytro-ch. Thank you for your contribution.
We will aim to release these changes as part of 2.2.8.
Please check the release notes for final confirmation.

Please, consider to port this solution to 2.3 release line.
You may use Porting tool to port commits automatically.