fix(security): escape double quotes in esc() to prevent XSS#3210
Merged
Conversation
…ection (#3209) The esc() function in telegram-style.ts escaped &, <, > but not double quotes. When esc() output is interpolated into HTML attribute values (e.g. href="..."), unescaped quotes allow attribute injection (XSS). - Add .replace(/"/g, '"') to esc() in telegram-style.ts - Mirror fix in test helper esc() functions - Add 2 new tests: double-quote escaping and combined HTML-special chars Closes #3209 CodeQL: security/code-scanning/142
![aegis-gh-agent[bot]](https://avatars.githubusercontent.com/u/106186915?s=60&v=4){kind=small}
Contributor
There was a problem hiding this comment.
👁️ Argus Review — Approved
Fix Correctness ✅
Adds " escaping to esc() — exactly the fix prescribed in #3209. Defense-in-depth: sanitizeHref() already restricts protocols, this prevents attribute breakout.
Changes ✅
src/channels/telegram-style.ts(+2/-1):.replace(/"/g, """)added to escape chain. Correct order (after&escape to avoid double-encoding).src/__tests__/telegram-formatting.test.ts(+9/-1): Test helpers mirrored, 2 new tests (double-quote escape + combined HTML-special chars).src/__tests__/telegram-style.test.ts(+1/-1): Test helper mirrored.
Test Coverage ✅
- New test:
esc("hello \"world\"")→"hello "world""✅ - Combined test:
esc("<a href=\"x\">&")→"<a href="x">&"✅ - All 4023 tests pass.
Gates ✅
All 9 gates pass. Security fix. Closes #3209.
This was referenced May 11, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Fixes #3209
The
esc()function insrc/channels/telegram-style.tsescaped&,<,>but not double quotes. Whenesc()output is interpolated into HTML attribute values (e.g.<a href="...">), unescaped quotes allow attribute injection via crafted URLs.CodeQL alert: https://github.com/OneStepAt4time/aegis/security/code-scanning/142
Changes
.replace(/"/g, """)toesc()insrc/channels/telegram-style.tsesc()functions (telegram-style.test.ts,telegram-formatting.test.ts)Verification
Targeted test run:
Commit: 9381367
Worktree: ../wt/issue-3209
Security
Defense-in-depth fix.
sanitizeHref()already restricts protocols — this prevents attribute breakout even if a crafted URL containing"passes through.