@xterm/xterm 6.0.0 and @xterm/addon-fit 0.11.0 replace xterm 3.6.0; the page reads typed and pasted input with onData, and no longer writes every key and all terminal output to the browser console. The unused fullscreen addon goes.
- Validate and coerce console query parameters (view_only, scale, resize_session, clip_viewport) to strict booleans via to_bool in console/views.py
- Sanitize view parameter to strictly 'lite' or 'full'
- Apply escapejs filter to all JS string interpolations in console-vnc-full.html, console-vnc-lite.html, console-spice-lite.html, and console-xterm.html
- Replace unsafe '| safe' filter in console-spice-lite.html with escapejs
- Add unit tests for XSS query param mitigation and escapejs character encoding
