[Port to 1.x] GrapesJsNewsletterHtmlEditor produces HTML with JavaScript code that can be executed in template preview

[Flaurite]

Environment

Jmix version: 1.7.1

Bug Description

Support forum discussion: topic.

If the user add a link with the following attribute: href="javascript:alert('1')", it will be executed in the Email Template preview.

Note that in Jmix 2.x by default HTML files are not opened in the web browser but downloaded.

Steps To Reproduce

1. Add email template add-on
2. Launch the application
3. Create template, add "link" element
4. Edit code of template and add href="javascript:alert('1')" to the link.
5. Click on preview button
6. In the opened tab click on the link.

Current Behavior

The JS executed within Jmix application:

Expected Behavior

The JS code should not be executed within Jmix application. The HTML can be downloaded or we should sanitize HTML.

[glebfox]

For future assignee: create an issue for 2.x