feat: add input sanitization to subscription JSONB filters

[Copilot]

Subscription filters are stored as JSONB and could contain malicious content (XSS payloads, SQL injection patterns) that may be exploited if displayed in UIs or logs without proper escaping.

Changes

New sanitizer module (fastpubsub/sanitizer.py)

• sanitize_filter() - validates structure and sanitizes all keys/values
• HTML entity encodes special characters (<>&"')
• Strips control characters (null bytes, etc.)
• Enforces strict schema: dict[str, list[str|int|float|bool]]

Model integration (fastpubsub/models.py)

• Added Pydantic field validator to CreateSubscription.filter
• Sanitization applied automatically on subscription creation

Test coverage (tests/test_sanitizer.py, tests/test_api.py)

• Unit tests for sanitizer functions (XSS, SQL patterns, control chars, structure validation)
• Integration tests for API endpoints with malicious payloads

Example

# Before: XSS payload stored as-is
CreateSubscription(
    id="sub", 
    topic_id="topic",
    filter={"field": ["<script>alert('xss')</script>"]}
)

# After: Sanitized automatically
# filter becomes {"field": ["&lt;script&gt;alert(&#x27;xss&#x27;)&lt;/script&gt;"]}

Invalid structures now raise ValueError:

# Rejected: values must be arrays
filter={"field": "string"}  # ❌

# Rejected: only primitives allowed
filter={"field": [{"nested": "object"}]}  # ❌

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• astral.sh
  • Triggering command: /usr/bin/curl curl -LsSf REDACTED (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Add sanitization against SQL and XSS injections in the JSONB filter of the subscription to increase project security.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.