fix(agent-bff): sanitize action result html before relaying - #1859

Merged

Tonours merged 15 commits into

mainfrom

fix/prd-1095-action-html-xss

Sep 2, 2026

Commits on Aug 28, 2026

fix(agent-bff): sanitize action result html before relaying
Tonours
committed
793c5dd
test(agent-bff): cover script vector in html sanitize fixture
Tonours
committed
20b2eb4

Commits on Aug 31, 2026

test(agent-bff): document the deliberate non-string html cast
Tonours
committed
9a63eca

Commits on Sep 1, 2026

chore(agent-bff): keep the sanitize-html lockfile delta minimal
Tonours
committed
30fa6ac
fix(agent-bff): relay a fully stripped action html as no html
Tonours
committed
672aecc
fix(agent-bff): sanitize the action form htmlBlock layout content
Tonours
committed
b16a350
refactor(agent-bff): drop the null round-trip in the layout sanitizer
Tonours
committed
e29e7a7
fix(agent-bff): keep presentational inline styles when sanitizing
Tonours
committed
3dc2f59
fix(agent-bff): cap and log the action html the bff sanitizes
Tonours
committed
54f5354
fix(agent-bff): bound the layout depth the BFF sanitizer recurses into
Tonours
committed
aef6fc1