Missing icons due to v-safe-html and spriteIcons interaction
The effort to migrate existing v-html usage to v-safe-html had an unintended side-effect on some SVG icons, making them empty:
The reason is that, in some places, we were using v-html to render icons using the spriteIcon helper. When these are switched to v-safe-html, e.g., in 0409352d, the icons no longer render.
This is because dompurify (correctly) considers <use href="..."> references to external entities as unsafe, and so filters them out completely.
There are a few approaches we can take to address this, in order of preference:
- Migrate these cases to use GlIcon, avoiding bothv-htmlandv-safe-htmlentirely
- Set some kind of dompurifyhook to special-case these links, and let them through (see https://github.com/cure53/DOMPurify/issues/233 for some examples)
- Keep these as v-html
cc @djadmin
Edited  by Mark Florian
