fix(security): escape entry.id in HTML export to prevent attribute XSS (#83104)

SebTardif · web-flow · commit 7bc4a333aa09 · 2026-05-22T21:27:14.000+01:00
* fix(security): escape entry.id in HTML export to prevent attribute XSS

Apply escapeHtmlAttr to entry.id in renderEntry and renderCopyLinkButton
to prevent attribute injection via crafted entry IDs in HTML exports.

Signed-off-by: Sebastien Tardif &lt;sebtardif@ncf.ca&gt;

* chore: remove proof helper scripts from branch

ClawSweeper P2: committed proof scripts can provide false-positive
validation. Proof output is in the PR body instead.

Signed-off-by: Sebastien Tardif &lt;sebtardif@ncf.ca&gt;

---------

Signed-off-by: Sebastien Tardif &lt;sebtardif@ncf.ca&gt;
diff --git a/src/auto-reply/reply/export-html/template.js b/src/auto-reply/reply/export-html/template.js
@@ -1309,7 +1309,7 @@
    * Render the copy-link button HTML for a message.
    */
   function renderCopyLinkButton(entryId) {
-    return `<button class="copy-link-btn" data-entry-id="${entryId}" title="Copy link to this message">
+    return `<button class="copy-link-btn" data-entry-id="${escapeHtmlAttr(entryId)}" title="Copy link to this message">
           <svg width="14" height="14" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
             <path d="M10 13a5 5 0 0 0 7.54.54l3-3a5 5 0 0 0-7.07-7.07l-1.72 1.71"/>
             <path d="M14 11a5 5 0 0 0-7.54-.54l-3 3a5 5 0 0 0 7.07 7.07l1.71-1.71"/>
@@ -1320,7 +1320,7 @@
   function renderEntry(entry) {
     const ts = formatTimestamp(entry.timestamp);
     const tsHtml = ts ? `<div class="message-timestamp">${ts}</div>` : "";
-    const entryId = `entry-${entry.id}`;
+    const entryId = `entry-${escapeHtmlAttr(entry.id)}`;
     const copyBtnHtml = renderCopyLinkButton(entry.id);
 
     if (entry.type === "message") {
diff --git a/src/auto-reply/reply/export-html/template.security.test.ts b/src/auto-reply/reply/export-html/template.security.test.ts
@@ -494,6 +494,104 @@ describe("export html security hardening", () => {
     );
   });
 
+  it("escapes entry.id in element id and data-entry-id attributes", async () => {
+    const xssId = `"><script>alert(1)</script><div data-x="`;
+    const session: SessionData = {
+      header: { id: "session-xss-id", timestamp: now() },
+      entries: [
+        {
+          id: xssId,
+          parentId: null,
+          timestamp: now(),
+          type: "message",
+          message: { role: "user", content: "hello" },
+        },
+        {
+          id: "safe-child",
+          parentId: xssId,
+          timestamp: now(),
+          type: "message",
+          message: {
+            role: "assistant",
+            content: [{ type: "text", text: "world" }],
+          },
+        },
+      ],
+      leafId: "safe-child",
+      systemPrompt: "",
+      tools: [],
+    };
+
+    const { document } = await renderTemplate(session);
+    const messages = requireElement(document.getElementById("messages"), "messages root missing");
+
+    // Core XSS prevention: no <script> tags should be injected into the DOM
+    expect(messages.querySelectorAll("script").length).toBe(0);
+
+    // No attribute breakout: onmouseover, data-x must not appear as real attributes
+    expect(messages.querySelector("[onmouseover]")).toBeNull();
+
+    // The copy-link button must exist with the payload safely contained
+    const copyBtn = requireElement(
+      messages.querySelector(".copy-link-btn"),
+      "copy-link button missing",
+    );
+    // data-entry-id must be present as a proper attribute (not broken out)
+    expect(copyBtn.hasAttribute("data-entry-id")).toBe(true);
+    // No stray attributes from the payload
+    expect(copyBtn.hasAttribute("data-x")).toBe(false);
+
+    // The user message element must not have attribute breakout either
+    const userMsg = requireElement(
+      messages.querySelector(".user-message"),
+      "user message element missing",
+    );
+    expect(userMsg.getAttribute("data-x")).toBeNull();
+    // The element id must start with entry- (the payload is contained within)
+    const elementId = userMsg.getAttribute("id") ?? "";
+    expect(elementId.startsWith("entry-")).toBe(true);
+  });
+
+  it("copy-link round-trip: dataset.entryId matches raw entry.id after browser decoding", async () => {
+    // IDs with characters that need HTML escaping but should round-trip correctly
+    const specialId = `msg-with"quotes&amp's`;
+    const session: SessionData = {
+      header: { id: "session-roundtrip", timestamp: now() },
+      entries: [
+        {
+          id: specialId,
+          parentId: null,
+          timestamp: now(),
+          type: "message",
+          message: { role: "user", content: "test" },
+        },
+      ],
+      leafId: specialId,
+      systemPrompt: "",
+      tools: [],
+    };
+
+    const { document } = await renderTemplate(session);
+    const messages = requireElement(document.getElementById("messages"), "messages root missing");
+
+    // The copy-link button should exist
+    const copyBtn = requireElement(
+      messages.querySelector(".copy-link-btn"),
+      "copy-link button missing",
+    );
+
+    // Browser decodes HTML entities in dataset reads, so dataset.entryId
+    // must return the RAW entry.id (not the HTML-escaped version).
+    // This is essential for buildShareUrl() to produce the correct URL.
+    const datasetValue = (copyBtn as HTMLElement).dataset.entryId;
+    expect(datasetValue).toBe(specialId);
+
+    // The DOM element id must also round-trip: getElementById should find it
+    const userMsg = document.getElementById(`entry-${specialId}`);
+    expect(userMsg).not.toBeNull();
+    expect(userMsg?.classList.contains("user-message")).toBe(true);
+  });
+
   it("escapes markdown data-image attributes", async () => {
     const dataImage = "data:image/png;base64,AAAA";
     const session: SessionData = {
