pook/compliancebot
1
0
Fork 0
Code Issues 1.1k Pull requests 82 Projects Releases Packages Wiki Activity Actions

fix: HTML entity encoding for AI-generated output before storage #217

Closed
pook wants to merge 2 commits from fix/134-sanitize-ai-output into main
pull from: fix/134-sanitize-ai-output
merge into: pook:main
Conversation 1 Commits 2 Files changed 7 +409
pook commented 2026-04-09 03:50:56 -04:00
Owner
Copy link

Summary

  • Adds sanitizeOutput() utility that encodes <, >, &, ", ' as HTML entities to prevent stored XSS
  • Applied to AI-generated content in both privacy-policy (generate.ts) and ToS (generate-tos.ts) routes before database writes
  • Includes 8 unit tests covering all 5 dangerous characters, clean passthrough, combined input, and empty string

Test plan

  • bun test src/services/sanitize.test.ts — 8/8 passing
  • Verify privacy-policy generation stores encoded content
  • Verify ToS generation stores encoded content

Closes #134

🤖 Generated with Claude Code

## Summary - Adds `sanitizeOutput()` utility that encodes `<`, `>`, `&`, `"`, `'` as HTML entities to prevent stored XSS - Applied to AI-generated content in both privacy-policy (`generate.ts`) and ToS (`generate-tos.ts`) routes before database writes - Includes 8 unit tests covering all 5 dangerous characters, clean passthrough, combined input, and empty string ## Test plan - [x] `bun test src/services/sanitize.test.ts` — 8/8 passing - [ ] Verify privacy-policy generation stores encoded content - [ ] Verify ToS generation stores encoded content Closes #134 🤖 Generated with [Claude Code](https://claude.com/claude-code)
Prevents stored XSS by sanitizing AI-generated content before writing to
the database. Adds sanitizeOutput() utility that encodes <, >, &, ", '
as HTML entities, applied in both privacy-policy and ToS generation routes.

Closes #134

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
pook commented 2026-04-10 15:06:04 -04:00
Author
Owner
Copy link

Closed 2026-04-10 during pipeline triage.

Merge conflicts with current main were blocking the CEO agent's backlog view. Reopen / resubmit against current main if the work is still relevant — CEO now injects open issues/PRs into its prompt and avoids duplicating.

Closed 2026-04-10 during pipeline triage. Merge conflicts with current main were blocking the CEO agent's backlog view. Reopen / resubmit against current main if the work is still relevant — CEO now injects open issues/PRs into its prompt and avoids duplicating.
pook closed this pull request 2026-04-10 15:06:04 -04:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
agent-task

Task for autonomous agent execution

  
agent-task

Paperclip autonomous agent task

No labels
agent-task
agent-task
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
2 participants
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
pook/compliancebot!217
No description provided.