From 7617c1ad920b519893882801494e80ec88aa0fd3 Mon Sep 17 00:00:00 2001
From: Justin Barnett <barnett.justin.p@gmail.com>
Date: Mon, 27 Apr 2026 17:22:06 -0400
Subject: [PATCH] fix(coding-agent): escape exported image data (#3819)

Fixes #3811
---
 packages/coding-agent/src/core/export-html/template.js | 4 ++--
 packages/coding-agent/test/export-html-xss.test.ts     | 6 ++++++
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/packages/coding-agent/src/core/export-html/template.js b/packages/coding-agent/src/core/export-html/template.js
index 3f4c40f6..27dff747 100644
--- a/packages/coding-agent/src/core/export-html/template.js
+++ b/packages/coding-agent/src/core/export-html/template.js
@@ -881,7 +881,7 @@
           const images = getResultImages();
           if (images.length === 0) return '';
           return '<div class="tool-images">' +
-            images.map(img => `<img src="data:${escapeHtml(img.mimeType || 'image/png')};base64,${img.data}" class="tool-image" />`).join('') +
+            images.map(img => `<img src="data:${escapeHtml(img.mimeType || 'image/png')};base64,${escapeHtml(img.data || '')}" class="tool-image" />`).join('') +
             '</div>';
         };
 
@@ -1148,7 +1148,7 @@
               if (images.length > 0) {
                 html += '<div class="message-images">';
                 for (const img of images) {
-                  html += `<img src="data:${escapeHtml(img.mimeType || 'image/png')};base64,${img.data}" class="message-image" />`;
+                  html += `<img src="data:${escapeHtml(img.mimeType || 'image/png')};base64,${escapeHtml(img.data || '')}" class="message-image" />`;
                 }
                 html += '</div>';
               }
diff --git a/packages/coding-agent/test/export-html-xss.test.ts b/packages/coding-agent/test/export-html-xss.test.ts
index 077a0d12..88f4298e 100644
--- a/packages/coding-agent/test/export-html-xss.test.ts
+++ b/packages/coding-agent/test/export-html-xss.test.ts
@@ -25,4 +25,10 @@ describe("export HTML markdown link sanitization", () => {
 		expect(templateJs).not.toMatch(/\$\{img\.mimeType\}/);
 		expect(templateJs).toMatch(/escapeHtml\(img\.mimeType/);
 	});
+
+	it("escapes image data attributes", () => {
+		// Image data is embedded in src attributes and must not allow attribute breakout.
+		expect(templateJs).not.toMatch(/;base64,\$\{img\.data\}"/);
+		expect(templateJs).toMatch(/;base64,\$\{escapeHtml\(img\.data \|\| (?:''|"")\)\}"/);
+	});
 });