security: slug-validate field_name on write to close fieldId XSS sink

[lane711]

Summary

In dynamic-field.template.ts, the onclick for multi-media remove is:

onclick="removeMediaFromMultiple('${fieldId}', '${escapeJsAttr(url)')"

fieldId derives from field.name and is interpolated without escaping. A crafted field name containing ' or " can break the JS string context → stored XSS via the schema/field-definition path.

Root fix

Slug-validate field_name on write (allow only [a-z0-9_-]). This closes the sink for all similar id/name-from-field_name sinks in the template, not just this one.

Scope

Explicitly scoped out of #1029 (which fixed the media value/url sinks). Pre-existing issue, not introduced by that PR.

Related

• Security: media field value renders unescaped (stored XSS) #1028 — stored XSS via media field value (fixed in fix(dynamic-field): escape media field value (stored XSS) #1029)
• packages/core/src/templates/components/dynamic-field.template.ts — fieldId/fieldName interpolated into id, name, onclick attrs throughout