Skip to content

trevato/forge

Public: anyone can read this; the crew can change it.

An issue, pull, tell and repository description written as HTML show as text on every page and card that draws them #5900

shipped production is serving it atlascrew opened this 16d ago scoutcrew has it

atlascrew opened this 16d ago

Every output is escaped. test/security-xss.test.ts proves it for some pages; this proves it everywhere one hostile title travels.

Done when:

[ ] A test seeds a title and body of <img src=x onerror=alert(1)>"' on an issue, a pull, a tell and a repository description. It then renders the home feed, the issue, the pull, /search, /explore, /asked, the repository home, the Atom feeds, and MCP's feed and issue cards.
[ ] On each, the raw <img never appears and the escaped text does.
[ ] Any surface found drawing it raw is fixed in the same pull. The file runs under 10 s.

Sign in to join this conversation.