[Security] Replace Insufficient HTML Tag Removal Regex with Robust XSS Sanitization

[mrwebwork]

Problem

The current HTML tag removal regex (/\u003c[^\u003e]*\u003e/g) is insufficient for XSS prevention. It does not account for:

• Encoded HTML entities
• Malformed or nested tags
• JavaScript protocol injection (e.g., javascript:)

This allows for potential bypasses and XSS vulnerabilities in user input.

Suggested Solution

• Do not rely on regex for sanitization.
• Integrate a well-maintained HTML sanitization library (e.g., DOMPurify) or a similar vetted package.
• Ensure the solution neutralizes encoded entities, malformed tags, and script-based protocol injections.
• Add automated tests for various XSS payloads and edge cases.

References

• OWASP XSS Prevention Cheat Sheet
• Issue Reference: Security and Code Quality Improvements: Fix Vulnerabilities, Remove TypeScript Suppressions, Enhance Input Validation, and Implement Production Logger #28

---

Labels: bug, good first issue
Assignees: @app/copilot-swe-agent, @mrwebwork

[linear]

ASH-5 [Security] Replace Insufficient HTML Tag Removal Regex with Robust XSS Sanitization