USWDS - Footer: Prevent unsafe element creation from data-tag attribute - #6674

Summary

Creates a fixed list of acceptable elements that are not passed manually from the DOM, via data-tag. Prevents attackers from exploiting unsanitized HTML reassignment. Related CodeQL finding.

Breaking change

⚠️ This is potentially a breaking change.

This change narrows the allowable elements of data-tag from any DOM element to only heading elements. This follows the intent of the footer component, but in certain circumstances, would affect projects where data-tag was manually set to something other than a heading element. This change gracefully sets "unacceptable" elements back to h4, which was the behavior prior to #5044, while still preserving any heading elements (i.e. h1 stays h1).

Related issue

Closes #6521

Testing and review

Adds a new test to ensure any non-heading element passed to data-tag gracefully falls back to h4 .

• Confirm that this code follows the 18F Front End Coding Style Guide and Accessibility Guide.
• Run git pull origin [base branch] to pull in the most recent updates from your base and check for merge conflicts. (Often, the base branch is develop).
• Run npm run prettier:sass to format any Sass updates.
• Run npm test and confirm that all tests pass.
• Run your code through HTML_CodeSniffer and make sure it’s error free.