Are URLs in rows response sanitized?
see https://github.com/huggingface/moon-landing/pull/7798#discussion_r1369813236 (internal)

> Is "src" validated / sanitized?
> if not there is a potential XSS exploit here (you can inject javascript code in an image src)

> Are S3 object names sanitized? If no, it should be the case in dataset-server side
Are URLs in rows response sanitized?: see https://github.com/huggingface/moon-landing/pull/7798#discussion_r1369813236 (internal)

> Is "src" validated / sanitized?
> if not there is a potential XSS exploit here (you can inject javascript code in an image src)

> Are S3 object names sanitized? If no, it should be the case in dataset-server side