TablePanel: Fix XSS issue in header column rename (#23816)

* prevent xss

* added escaping on tooltip.

* Rebase done

Co-authored-by: Marcus Andersson <marcus.andersson@grafana.com>

public/app/plugins/panel/table-old/renderer.ts

@@ -56,7 +56,7 @@ export class TableRenderer {
           column.style = style;
 
           if (style.alias) {
-            column.title = column.text.replace(regex, style.alias);
+            column.title = textUtil.escapeHtml(column.text.replace(regex, style.alias));
           }
 
           break;
@@ -300,7 +300,7 @@ export class TableRenderer {
       const cellLink = this.templateSrv.replace(column.style.linkUrl, scopedVars, encodeURIComponent);
       const sanitizedCellLink = textUtil.sanitizeUrl(cellLink);
 
-      const cellLinkTooltip = this.templateSrv.replace(column.style.linkTooltip, scopedVars);
+      const cellLinkTooltip = textUtil.escapeHtml(this.templateSrv.replace(column.style.linkTooltip, scopedVars));
       const cellTarget = column.style.linkTargetBlank ? '_blank' : '';
 
       cellClasses.push('table-panel-cell-link');