I'm trying to determine if code from a colleague is vulnerable to XSS. They are building a widget that accepts user input as query parameters to configure a user interface built with Konva and HTML canvas.

The program will use the user input to add text to a user interface or specify a hexadecimal color string to configure some primary colors of the UI. They are allowing the widget to be configured via query parameters so configured widgets can be shared easily with other people.

My question is, assuming the web application properly strips or sanitizes all HTML tags and quotes from the user input, is it still possible for an XSS vulnerability if the user sends through any vanilla or encoded javascript?

Ruby on Rails (ERB) Example:

<input id="widget-title" type="text" value="<%= params[:title] %>">
<input id="widget-color" type="color" value="<%= params[:color] %>">

We have javascript that will take these values and display on a canvas like:

new Konva.Text({
text: document.querySelector("#widget-title").value(),
color: document.querySelector("#widget-color").value()
});

Again, assuming that HTML tags and quotes are stripped or sanitized to hexadecimal, could a user enter (hex-encoded) javascript into the query parameters somehow to execute arbitrary js?

If this is not directly possible, are there other concerns with this approach? I have seen some usages of inline javascript like:

<tr background="javascript:alert(window.location)"></tr>

If a future developer were to implement this while passing user input, that would be bad. But I can't find a spec on what HTML attributes allow inline javascript like this or if there is perhaps another way to encode raw javascript that could potentially be executed when it's the value of text input (except for, of course, using something like eval).