BUG: Values are not escaped

GrapesJS code is open to XSS issues because values are inserted into DOM without escaping, e.g. https://github.com/artf/grapesjs/blob/dev/src/asset_manager/view/AssetImageView.js#L30

If model.getFilename() returns <img src=x onerror=alert(document.cookie)>.jpg, this can result in an account takeover. Instead the code should be for example:

    return `
      <div class="${_.escape(pfx)}name">${_.escape(name)}</div>
      <div class="${_.escape(pfx)}dimensions">${_.escape(dim)}</div>
    `;

Similar issue here https://github.com/artf/grapesjs/blob/dev/src/asset_manager/view/AssetImageView.js#L15 and fix would be the same:

    return `
      <div class="${_.escape(pfx)}preview" style="background-image: url('${_.escape(src)}');"></div>
      <div class="${_.escape(pfx)}preview-bg ${_.escape(this.ppfx)}checker-bg"></div>
    `;

To be one the save side, everything that is injected into HTML code must be escaped.