Shield: Add input sanitization and length validation to Contact form

Added `sanitizeInput` utility to escape HTML characters.
Updated `Contact.tsx` to sanitize inputs before sending via `emailjs`.
Added max length validation for Name (100), Subject (200), and Message (5000).
Updated tests to cover sanitization and validation logic, including adding `cleanup()` to prevent test leakage.
This commit is contained in:
google-labs-jules[bot]
2026-01-24 10:05:33 +00:00
parent 77fd62447c
commit 6801682c2e
4 changed files with 98 additions and 6 deletions

18
src/utils/security.ts Normal file
View File

@@ -0,0 +1,18 @@
/**
* Sanitizes user input by encoding special HTML characters.
* Prevents XSS attacks by ensuring input is treated as text, not HTML.
*
* @param input - The raw string input from the user.
* @returns The sanitized string with special characters encoded.
*/
export function sanitizeInput(input: string): string {
if (typeof input !== "string") {
return input;
}
return input
.replace(/&/g, "&")
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")
.replace(/"/g, "&quot;")
.replace(/'/g, "&#039;");
}