HUE-4705 [editor] Possible XSS when hovering on saved query description

Moved to the tooltip ko binding instead of one off in the template.

desktop/core/src/desktop/static/desktop/js/hue.utils.js

@@ -363,3 +363,7 @@ if (!('getParameter' in window.location)) {
     return results === null ? "" : decodeURIComponent(results[1].replace(/\+/g, " "));
   };
 }
+
+var escapeOutput = function (str) {
+  return $('<span>').text(str).html().trim();
+};

desktop/core/src/desktop/static/desktop/js/ko.hue-bindings.js

@@ -1844,6 +1844,11 @@
 
       ko.utils.extend(options, local);
 
+      if (options.title) {
+        var title = ko.unwrap(options.title); // Not always an observable
+        options.title = escapeOutput(title);
+      }
+
       $(element).tooltip(options);
 
       ko.utils.domNodeDisposal.addDisposeCallback(element, function () {