chore(agent-bff): merge main into action input validation branch

Combine isEnumFieldType validation with sanitizeActionLayout from #1859.

Co-authored-by: Cursor <cursoragent@cursor.com>

Author: Tonours

packages/agent-bff/CHANGELOG.md

@@ -1,3 +1,10 @@
+## @forestadmin/agent-bff [1.23.5](https://github.com/ForestAdmin/agent-nodejs/compare/@forestadmin/agent-bff@1.23.4...@forestadmin/agent-bff@1.23.5) (2026-09-02)
+
+
+### Bug Fixes
+
+* **agent-bff:** sanitize action result html before relaying ([#1859](https://github.com/ForestAdmin/agent-nodejs/issues/1859)) ([695e160](https://github.com/ForestAdmin/agent-nodejs/commit/695e160361be95d9ef90da051f1e35e1de841f53))
+
 ## @forestadmin/agent-bff [1.23.4](https://github.com/ForestAdmin/agent-nodejs/compare/@forestadmin/agent-bff@1.23.3...@forestadmin/agent-bff@1.23.4) (2026-09-01)
 
 

packages/agent-bff/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@forestadmin/agent-bff",
-  "version": "1.23.4",
+  "version": "1.23.5",
   "main": "dist/index.js",
   "bin": {
     "forest-bff": "dist/cli.js"
@@ -39,6 +39,7 @@
     "@koa/bodyparser": "^6.1.0",
     "jsonwebtoken": "^9.0.3",
     "koa": "^3.0.1",
+    "sanitize-html": "2.17.5",
     "zod": "4.3.6"
   },
   "devDependencies": {
@@ -48,6 +49,7 @@
     "@redocly/cli": "2.35.1",
     "@types/jsonwebtoken": "^9.0.1",
     "@types/koa": "^2.13.5",
+    "@types/sanitize-html": "^2.16.1",
     "@types/supertest": "^6.0.2",
     "openapi3-ts": "4.6.1",
     "redoc": "2.5.3",

packages/agent-bff/src/action/action-execute-mapper.ts

@@ -1,3 +1,7 @@
+import type { Logger } from '../ports/logger-port';
+
+import sanitizeActionHtml from './sanitize-action-html';
+
 export interface ActionExecuteSuccessBody {
   type: 'success';
   message: string | null;
@@ -63,7 +67,7 @@ function isRefresh(value: unknown): value is { relationships: unknown[] } {
 // untyped at the BFF boundary (`Action.execute(): Promise<unknown>`), so we discriminate on the
 // agent HTTP payload shape. A File result streams a binary with no JSON marker, so any unrecognized
 // 200 body falls through to a structured 501 rather than being mislabelled.
-export function mapActionExecuteResult(raw: unknown): ActionExecuteMapped {
+export function mapActionExecuteResult(raw: unknown, logger: Logger): ActionExecuteMapped {
   const body = (typeof raw === 'object' && raw !== null ? raw : {}) as Record<string, unknown>;
 
   // Each branch validates the value shape, not just key presence: a malformed payload
@@ -90,7 +94,7 @@ export function mapActionExecuteResult(raw: unknown): ActionExecuteMapped {
         type: 'success',
         message: typeof body.success === 'string' ? body.success : null,
         invalidated: relationships.filter((name): name is string => typeof name === 'string'),
-        html: typeof body.html === 'string' ? body.html : null,
+        html: sanitizeActionHtml(body.html, logger),
       },
     };
   }

packages/agent-bff/src/action/action-form-mapper.ts

@@ -1,6 +1,8 @@
 import type { ActionForm, ActionFormField } from './agent-action-client';
+import type { Logger } from '../ports/logger-port';
 import type { ForestServerActionFormLayoutElement } from '@forestadmin/forestadmin-client';
 
+import { sanitizeActionLayout } from './sanitize-action-html';
 import { isEnumFieldType } from '../read-model/field-type';
 
 export interface ActionFormFieldResponse {
@@ -33,6 +35,7 @@ export function mapActionForm(
   action: ActionForm,
   skippedFields: string[],
   layout: ForestServerActionFormLayoutElement[],
+  logger: Logger,
 ): ActionFormResponse {
   const fields = action.getFields();
 
@@ -57,6 +60,6 @@ export function mapActionForm(
     canExecute: requiredFields.length === 0,
     requiredFields,
     skippedFields,
-    layout,
+    layout: sanitizeActionLayout(layout, logger),
   };
 }

packages/agent-bff/src/action/action-routes-middleware.ts

@@ -19,6 +19,7 @@ import { mapActionExecuteResult } from './action-execute-mapper';
 import { mapActionForm } from './action-form-mapper';
 import assertActionValuesExecutable from './action-values-validator';
 import defaultCreateAgentActionClient, { extractRawLayout } from './agent-action-client';
+import sanitizeActionHtml from './sanitize-action-html';
 import { mapAgentError } from '../http/agent-error-mapper';
 import {
   callAgent,
@@ -115,7 +116,7 @@ async function handleForm({
   const skippedFields = await callAgent(() => action.tryToSetFields(values), logger);
 
   ctx.status = 200;
-  ctx.body = mapActionForm(action, skippedFields, extractRawLayout(action));
+  ctx.body = mapActionForm(action, skippedFields, extractRawLayout(action), logger);
 }
 
 async function handleExecute({
@@ -154,13 +155,15 @@ async function handleExecute({
     }
 
     if (error instanceof ActionFormValidationError) {
-      throw actionError(error.message, error.html !== undefined ? { html: error.html } : undefined);
+      const html = sanitizeActionHtml(error.html, logger);
+
+      throw actionError(error.message, html === null ? undefined : { html });
     }
 
     throw mapAgentError(error, { logger });
   }
 
-  const { status, body } = mapActionExecuteResult(raw);
+  const { status, body } = mapActionExecuteResult(raw, logger);
 
   // An unrecognized payload (a File stream, or a new agent result type) maps to a generic 501 with
   // no trace of what it was; log a short shape hint so the case can be diagnosed without the body.

packages/agent-bff/src/action/agent-action-client.ts

@@ -56,7 +56,7 @@ export interface AgentActionClientOptions {
 export function extractRawLayout(action: ActionForm): ForestServerActionFormLayoutElement[] {
   const root = action.getLayout() as { layout?: ForestServerActionFormLayoutElement[] };
 
-  return root.layout ?? [];
+  return Array.isArray(root.layout) ? root.layout : [];
 }
 
 /**

packages/agent-bff/src/action/sanitize-action-html.ts

@@ -0,0 +1,139 @@
+import type { Logger } from '../ports/logger-port';
+import type { ForestServerActionFormLayoutElement } from '@forestadmin/forestadmin-client';
+
+import sanitizeHtml from 'sanitize-html';
+
+const MAX_HTML_CHARACTERS = 256 * 1024;
+
+const MAX_LAYOUT_DEPTH = 10;
+
+const SAFE_STYLE_VALUE =
+  /^(?![^;{}\\]*(?:url|expression|image-set|element|-moz-binding)\s*\()[^;{}\\]*$/i;
+
+const ALLOWED_STYLE_PROPERTIES = [
+  'background',
+  'background-color',
+  'border',
+  'border-bottom',
+  'border-collapse',
+  'border-left',
+  'border-radius',
+  'border-right',
+  'border-top',
+  'color',
+  'display',
+  'font-family',
+  'font-size',
+  'font-style',
+  'font-weight',
+  'height',
+  'letter-spacing',
+  'line-height',
+  'margin',
+  'margin-bottom',
+  'margin-left',
+  'margin-right',
+  'margin-top',
+  'max-width',
+  'min-width',
+  'opacity',
+  'overflow',
+  'padding',
+  'padding-bottom',
+  'padding-left',
+  'padding-right',
+  'padding-top',
+  'text-align',
+  'text-decoration',
+  'text-transform',
+  'vertical-align',
+  'white-space',
+  'width',
+];
+
+const OPTIONS: sanitizeHtml.IOptions = {
+  allowedAttributes: { ...sanitizeHtml.defaults.allowedAttributes, '*': ['style'] },
+  allowedClasses: { '*': ['c-*', 'l-*'] },
+  allowedStyles: {
+    '*': Object.fromEntries(ALLOWED_STYLE_PROPERTIES.map(name => [name, [SAFE_STYLE_VALUE]])),
+  },
+};
+
+function sanitize(html: unknown, logger: Logger): string | null {
+  if (typeof html !== 'string') return null;
+
+  let bounded = html;
+
+  if (bounded.length > MAX_HTML_CHARACTERS) {
+    logger('Warn', 'Action html truncated: longer than the sanitizable size', {
+      characters: bounded.length,
+      limit: MAX_HTML_CHARACTERS,
+    });
+
+    bounded = bounded.slice(0, MAX_HTML_CHARACTERS);
+  }
+
+  try {
+    return sanitizeHtml(bounded, OPTIONS) || null;
+  } catch (error) {
+    logger('Error', 'Action html dropped: sanitization failed', { cause: String(error) });
+
+    return null;
+  }
+}
+
+export default function sanitizeActionHtml(html: unknown, logger: Logger): string | null {
+  return sanitize(html, logger);
+}
+
+export function sanitizeActionLayout(
+  layout: ForestServerActionFormLayoutElement[],
+  logger: Logger,
+  depth = 0,
+  budget: { remaining: number } = { remaining: MAX_HTML_CHARACTERS },
+): ForestServerActionFormLayoutElement[] {
+  return layout.map(element => {
+    if (element?.component === 'htmlBlock') {
+      const { content } = element;
+
+      if (typeof content !== 'string') {
+        return { ...element, content: sanitize(content, logger) ?? '' };
+      }
+
+      if (content.length > budget.remaining) {
+        logger(
+          'Warn',
+          'Action layout html truncated: total layout html longer than the sanitizable size',
+          {
+            characters: content.length,
+            remaining: budget.remaining,
+            limit: MAX_HTML_CHARACTERS,
+          },
+        );
+      }
+
+      const bounded = content.slice(0, budget.remaining);
+
+      budget.remaining -= bounded.length;
+
+      return { ...element, content: sanitize(bounded, logger) ?? '' };
+    }
+
+    if (element?.component === 'page' && Array.isArray(element.elements)) {
+      if (depth >= MAX_LAYOUT_DEPTH) {
+        logger('Warn', 'Action layout elements dropped: nested deeper than the sanitizable depth', {
+          limit: MAX_LAYOUT_DEPTH,
+        });
+
+        return { ...element, elements: [] };
+      }
+
+      return {
+        ...element,
+        elements: sanitizeActionLayout(element.elements, logger, depth + 1, budget),
+      };
+    }
+
+    return element;
+  });
+}

packages/agent-bff/src/openapi/openapi-document.ts

@@ -268,7 +268,8 @@ const ROUTES: RouteDefinition[] = [
     summary: 'Load the form of a custom action',
     request: ActionRequestSchema,
     response: z.unknown(),
-    responseDescription: 'The action form fields',
+    responseDescription:
+      'The action form fields; htmlBlock layout content is sanitized server-side against an allowlist before relaying',
     params: ['collection', 'action'],
     bodyRequired: true,
   },
@@ -278,7 +279,8 @@ const ROUTES: RouteDefinition[] = [
     summary: 'Execute a custom action',
     request: ActionRequestSchema,
     response: z.unknown(),
-    responseDescription: 'The normalized action result',
+    responseDescription:
+      'The normalized action result; a success result html field is sanitized server-side against an allowlist before relaying',
     params: ['collection', 'action'],
     bodyRequired: true,
     executeResults: true,

packages/agent-bff/src/openapi/unfolded-paths.ts

@@ -573,7 +573,8 @@ function registerActionOperations(deps: Deps, plan: CollectionPlan, namer: Namer
       description: `Loads the form of the custom action. ${identity} An unknown submitted field is skipped here, not rejected.`,
       request,
       response: {},
-      responseDescription: 'The action form fields',
+      responseDescription:
+        'The action form fields; htmlBlock layout content is sanitized server-side against an allowlist before relaying',
       bodyRequired: true,
     });
 
@@ -585,7 +586,8 @@ function registerActionOperations(deps: Deps, plan: CollectionPlan, namer: Namer
       description: `Executes the custom action. ${identity} A submitted field the loaded form does not carry is rejected with 400.`,
       request,
       response: {},
-      responseDescription: 'The normalized action result',
+      responseDescription:
+        'The normalized action result; a success result html field is sanitized server-side against an allowlist before relaying',
       bodyRequired: true,
       executeResults: true,
     });