agent_coder 438ef091f9 fix(#288 review): markdown-safe-escape the untrusted page title in chat export ...

F1: pc.title (untrusted cross-user page title) was interpolated raw into the
markdown export heading. Reusing escapeAttr alone (the prompt sink's XML-attribute
sanitizer, strips < > ") is insufficient here because the sink is MARKDOWN: link
/image syntax survives, so a title like ![x](http://evil) or [phish](http://evil)
injects a remote image / clickable link into the downloaded .md disguised as a
trusted system annotation. Add markdownHeadingSafe() = escapeAttr() + backslash-
escape [ and ] (disables both [text](url) and ![text](url); a bare (url) is inert).
F2: cover the title branch — a title that collapses to empty via escapeAttr falls
to the bare heading (no ("")), and a link/image-injection title is neutralized
(non-vacuous vs the escapeAttr-only version).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-02 15:46:44 +03:00

..

client

Merge pull request 'feat(editor): inline image alignment — place several images side by side' (#284) from image-inline-row into develop

2026-07-02 14:12:05 +03:00

server

fix(#288 review): markdown-safe-escape the untrusted page title in chat export

2026-07-02 15:46:44 +03:00