shumengya/sproutclaw
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(coding-agent): escape exported session metadata (#3883)

Browse Source
This commit is contained in:
Justin Barnett
2026-04-28 05:46:42 -04:00
committed by GitHub
parent ed4bc73080
commit 57787b6557
2 changed files with 43 additions and 15 deletions
Download Patch File Download Diff File Expand all files Collapse all files

28
packages/coding-agent/test/export-html-xss.test.ts
View File

@@ -31,4 +31,32 @@ describe("export HTML markdown link sanitization", () => {
expect(templateJs).not.toMatch(/;base64,\$\{img\.data\}"/);
expect(templateJs).toMatch(/;base64,\$\{escapeHtml\(img\.data \|\| (?:''|"")\)\}"/);
});
it("escapes entry IDs before inserting them into attributes", () => {
// Session entry IDs are embedded in id and data-entry-id attributes.
expect(templateJs).not.toMatch(/id="\$\{entryId\}"/);
expect(templateJs).not.toMatch(/data-entry-id="\$\{entryId\}"/);
expect(templateJs).toMatch(/entry-\$\{escapeHtml\(entry\.id\)\}/);
expect(templateJs).toMatch(/data-entry-id="\$\{escapeHtml\(entryId\)\}"/);
});
it("escapes tree metadata rendered from session fields", () => {
// The tree renders session metadata via innerHTML, so dynamic fields must be escaped.
expect(templateJs).not.toMatch(/\[\$\{msg\.toolName \|\| 'tool'\}\]/);
expect(templateJs).not.toMatch(/\[\$\{msg\.role\}\]/);
expect(templateJs).not.toMatch(/\[model: \$\{entry\.modelId\}\]/);
expect(templateJs).not.toMatch(/\[thinking: \$\{entry\.thinkingLevel\}\]/);
expect(templateJs).not.toMatch(/\[\$\{entry\.type\}\]/);
expect(templateJs).toMatch(/\$\{escapeHtml\(msg\.toolName \|\| 'tool'\)\}/);
expect(templateJs).toMatch(/\$\{escapeHtml\(msg\.role\)\}/);
expect(templateJs).toMatch(/\$\{escapeHtml\(entry\.modelId\)\}/);
expect(templateJs).toMatch(/\$\{escapeHtml\(entry\.thinkingLevel\)\}/);
expect(templateJs).toMatch(/\$\{escapeHtml\(entry\.type\)\}/);
});
it("escapes model names in the exported header", () => {
// Assistant message provider/model values are collected from the session and rendered with innerHTML.
expect(templateJs).not.toMatch(/\$\{globalStats\.models\.join\(', '\) \|\| 'unknown'\}/);
expect(templateJs).toMatch(/\$\{escapeHtml\(globalStats\.models\.join\(', '\) \|\| 'unknown'\)\}/);
});
});