fix: sanitize AI-generated content to prevent stored XSS #139

Merged

pook merged 1 commit from fix/116-sanitize-ai-generated-content into main

2026-04-09 06:14:18 -04:00

pook commented

2026-04-08 21:22:42 -04:00

Owner

Summary

Adds sanitizeGeneratedContent() utility that HTML-entity-encodes <, >, &, ", and ' in AI-generated document content
Applied in document-generator.ts after receiving LLM output and before storing/returning, preventing stored XSS
11 unit tests covering malicious payloads (<script>, <img onerror>, nested tags, event handlers) and benign input (ampersands, quotes, Markdown syntax)

Closes #116

Test plan

<script>alert(1)</script> encoded to safe entities
<img onerror> XSS vectors neutralized
Legitimate content with &, quotes correctly encoded
Markdown syntax passes through unaffected
All 11 unit tests pass

## Summary - Adds `sanitizeGeneratedContent()` utility that HTML-entity-encodes `<`, `>`, `&`, `"`, and `'` in AI-generated document content - Applied in `document-generator.ts` after receiving LLM output and before storing/returning, preventing stored XSS - 11 unit tests covering malicious payloads (`<script>`, `<img onerror>`, nested tags, event handlers) and benign input (ampersands, quotes, Markdown syntax) Closes #116 ## Test plan - [x] `<script>alert(1)</script>` encoded to safe entities - [x] `<img onerror>` XSS vectors neutralized - [x] Legitimate content with `&`, quotes correctly encoded - [x] Markdown syntax passes through unaffected - [x] All 11 unit tests pass

pook added 1 commit

2026-04-08 21:22:42 -04:00

fix: sanitize AI-generated content to prevent stored XSS (#116 ) f69d9b0248

AI-generated documents were rendered in user browsers without HTML entity
encoding, creating a stored XSS vector. This adds sanitization of <, >, &,
", and ' in all generated text fields before storage and response.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>