Add a bulk-domain-action console endpoint

[gbrodman]

For now it only includes two options (domain deletion and domain suspension). In the future, as necessary, we can add other actions but this seems like a relatively simple starting point (actions like bulk updates are much more conceptually complex).

---

This change is 

[ptkach]

Reviewed 1 of 5 files at r1, all commit messages.
Reviewable status: 1 of 5 files reviewed, 1 unresolved discussion (waiting on @gbrodman)

---

core/src/main/java/google/registry/ui/server/console/ConsoleBulkDomainAction.java line 163 at r2 (raw file):

        consoleApiParams.gson().fromJson(jsonPayload, BulkDomainDeleteRequest.class).reason;
    return runCommandOverDomains(
        domainList, DOMAIN_DELETE_XML.replaceAll("%REASON%", reason), user);

I'm not sure this is safe. Can you add escpageXml here and below for both REASON and DOMAIN_NAMES before replacing?

Code quote:

DOMAIN_DELETE_XML.replaceAll

[gbrodman]

Reviewable status: 1 of 5 files reviewed, 1 unresolved discussion (waiting on @ptkach)

---

core/src/main/java/google/registry/ui/server/console/ConsoleBulkDomainAction.java line 163 at r2 (raw file):

Previously, ptkach (Pavlo Tkach) wrote…

I'm not sure this is safe. Can you add escpageXml here and below for both REASON and DOMAIN_NAMES before replacing?

yeah, good point -- we should use an escaper . Done.

We may wish to refactor out this XML parsing / loading at some point if we have a ton of XML templates, but this should be fine for now when it's just the two.

[ptkach]

Reviewed 1 of 5 files at r1, 2 of 3 files at r2, 1 of 1 files at r3, all commit messages.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on @gbrodman)