XSS vulnerability in alt attribute

Problem/Motivation

The module has a potential XSS vulnerability because it does not sanitize the value of alt attributes before using it as caption.

Steps to reproduce

Enable the ImageLightBox formatter on an image field.
Upload an image in this field and set this value as alternative text:

<img src=x onerror="alert()">

When clicking on the image, the malicious JS is executed.

Proposed resolution

captionReset() could use $captionObject.text() instead of $captionObject.html() to ensure the caption is sanitized.

Remaining tasks

User interface changes

API changes

Data model changes