[Security] XSS vulnerability in CLI site export (cli/index.ts)

[d-oit]

Description

The CLI exportSite() function builds HTML by string concatenation without escaping entity names, descriptions, or claim statements. This is the same XSS vulnerability as in the browser export, but in the CLI path.

Vulnerable Code

File: cli/index.ts (lines ~193-219)

if (entity.description) {
  html += `\n    <p>${entity.description}</p>\n`;
}

No escaping is applied to entity.description or claim.statement.

Impact

• Severity: Critical
• Exported static sites from CLI contain unescaped user content
• Same XSS risk as the browser export path

Recommended Fix

1. Reuse escapeHtml() from src/lib/security.ts in CLI export
2. Consider sharing export logic between browser and CLI (currently duplicated)
3. Add DOMPurify or equivalent sanitization for rich HTML content

Acceptance Criteria

• CLI export uses HTML escaping for all user-provided content
• Shared export utilities extracted to avoid duplication
• Security test for CLI export XSS prevention

[github-actions]

👋 This looks like a duplicate of #168.

The canonical issue has broader scope and/or more tasks — please subscribe there for updates.

⏳ This issue will be auto-closed in 3 days unless you react with 👎 to dispute.

Detected via title similarity analysis