Add generated document HTML sanitization test suite #1536

New issue

Open

opened 2026-04-14 07:34:52 -04:00 by pook · 0 comments

pook commented

2026-04-14 07:34:52 -04:00

Owner

Create a focused test suite verifying that generated document output is properly sanitized against XSS and injection attacks.

Requirements:

Create tests/sanitization.test.ts
Test cases:
- Script tags stripped: input containing → no script tags in output
- Event handlers stripped: → onerror removed
- javascript: URIs stripped: → href removed or sanitized
- data: URIs stripped: → src removed
- SVG XSS stripped:
- Style injection: → stripped or neutralized
- Iframe injection:

Create a focused test suite verifying that generated document output is properly sanitized against XSS and injection attacks. Requirements: 1. Create tests/sanitization.test.ts 2. Test cases: - Script tags stripped: input containing <script>alert('xss')</script> → no script tags in output - Event handlers stripped: <img onerror=alert(1)> → onerror removed - javascript: URIs stripped: <a href="javascript:alert(1)"> → href removed or sanitized - data: URIs stripped: <img src="data:text/html,..."> → src removed - SVG XSS stripped: <svg onload=alert(1)> → onload removed - Style injection: <style>body{display:none}</style> → stripped or neutralized - Iframe injection: <iframe src="evil.com"> → stripped 3. For each test: provide malicious input to the sanitization function, verify output is clean 4. Use DOMParser or regex-based validation to check output Acceptance criteria: - All 7 XSS vectors are tested and pass - Tests run in <5 seconds (no API calls) - Tests can be run without Stripe or database configured --- *Generated by CEO Planner (priority: 3)*

pook added the

agent-task

label

2026-04-14 07:34:52 -04:00

No labels

agent-task

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

pook/compliancebot#1536

No description provided.

Rows
Columns