MC-39039: Improve frontend messages displaying

Author: StasKozar

app/code/Magento/Security/view/base/web/js/escaper.js

@@ -157,7 +157,8 @@ define([], function () {
                     attribute = treeWalker.currentNode.attributes[i];
                     nodeName = treeWalker.currentNode.nodeName.toLowerCase();
 
-                    if (this.generallyAllowedAttributes.indexOf(attribute.name) === -1 || // eslint-disable-line max-depth,max-len
+                    if (this.generallyAllowedAttributes.indexOf(attribute.name) === -1  || // eslint-disable-line max-depth,max-len
+                        this._checkHrefValue(attribute) ||
                         this.forbiddenAttributesByElement[nodeName] &&
                         this.forbiddenAttributesByElement[nodeName].indexOf(attribute.name) !== -1
                     ) {
@@ -169,6 +170,16 @@ define([], function () {
             attributesToRemove.forEach(function (attributeToRemove) {
                 attributeToRemove.ownerElement.removeAttribute(attributeToRemove.name);
             });
+        },
+
+        /**
+         * Check that attribute contains script content
+         *
+         * @param {Object} attribute
+         * @private
+         */
+        _checkHrefValue: function (attribute) {
+            return attribute.nodeName === 'href' && attribute.nodeValue.startsWith('javascript');
         }
     };
 });

dev/tests/js/jasmine/tests/app/code/Magento/Security/view/base/web/js/escaper.test.js

@@ -131,6 +131,11 @@ define([
                 data: '<spa>n id="id1">Some string</span>',
                 expected: 'n id="id1"&gt;Some string',
                 allowedTags: ['span']
+            },
+            'link with script content': {
+                data: '<a href="javascript:void">Click</a>',
+                expected: '<a>Click</a>',
+                allowedTags: ['a']
             }
         };
     }