Merge pull request #713 from DIRACGridBot/cherry-pick-2-596ce115-integration

[sweep:integration] fix: escape url parameters

Author: fstagni

src/WebAppDIRAC/WebApp/handler/RootHandler.py

@@ -186,11 +186,11 @@ def web_index(self, *, url_state="", theme="crisp", open_app="", **kwargs):
             _dev=Conf.devMode(),
             logo=data["baseURL"] + Conf.getLogo(),
             view="tabs",
-            theme=theme.lower(),
+            theme=xhtml_escape(theme.lower()),
             title=Conf.getTitle(),
             welcome=welcome,
             iconUrl=data["baseURL"] + Conf.getIcon(),
-            open_app=open_app.strip(),
+            open_app=xhtml_escape(open_app.strip()),
             base_url=data["baseURL"],
             root_url=Conf.rootURL(),
             url_state=xhtml_escape(url_state),