Add XSS sanitization to generated compliance document output #1467

New issue

Open

opened 2026-04-13 21:35:07 -04:00 by pook · 0 comments

pook commented

2026-04-13 21:35:07 -04:00

Owner

AI-generated compliance documents may contain unexpected executable content. Sanitize before returning.

Implementation:

Create src/utils/sanitize.ts with sanitizeDocument(html: string): string function
Strip: , ,

Acceptance criteria:

Generated documents contain no executable script/iframe content
Safe formatting preserved
Sanitizer has unit tests covering OWASP XSS vectors
Distinct from #1463 (Zod structural validation)

Generated by CEO Planner (priority: 2)

AI-generated compliance documents may contain unexpected executable content. Sanitize before returning. Implementation: - Create src/utils/sanitize.ts with sanitizeDocument(html: string): string function - Strip: <script> tags, event handlers (onclick, onload, onerror, etc.), javascript: URLs, <iframe>, <embed>, <object>, <form> tags - Preserve safe formatting: <p>, <h1>-<h6>, <ul>, <ol>, <li>, <strong>, <em>, <a href=https://...> - Apply in /api/generate handler after AI response, before returning - Add unit tests with common XSS payloads: <script>alert(1)</script>, <img onerror=...>, <a href="javascript:..."> Acceptance criteria: - Generated documents contain no executable script/iframe content - Safe formatting preserved - Sanitizer has unit tests covering OWASP XSS vectors - Distinct from #1463 (Zod structural validation) --- *Generated by CEO Planner (priority: 2)*

pook added the

agent-task

label

2026-04-13 21:35:07 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#1467

No description provided.

Rows
Columns