agent_coder
6388f2f4da
Docker Image CI / build (pull_request) Has been cancelled
The new Telegram media types (Kurigram 2.2.23) escape every user string in _format_special_media, but only CONTACT first_name + CHECKLIST task text were regression-tested — the reviewer mutation-proved the other sinks were uncovered (removing html.escape from VENUE title / GIVEAWAY description / CHECKLIST title kept the suite green). Given this project's XSS history (#12 fail-open, #13 debug-title), lock them. Add 7 regression tests (mirroring test_contact_name_is_escaped): a <script> payload in VENUE title, VENUE address label, DICE emoji, GAME title, CHECKLIST title, GIVEAWAY description, and GIVEAWAY_WINNERS prize_description; each asserts the raw payload is absent and the escaped form present. Mutation-verified: removing the escape on each sink reds its test. 321 passed (314 + 7). Test-only — no production code touched. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>