🛡️ Sentinel: [Enhancement] Harden input sanitization and expand blocked domains #55

2026-02-04T01:52:32Z

ragusa-it commented

2026-02-04 01:52:32 +00:00

(Migrated from github.com)

🛡️ Sentinel Security Enhancement

Summary

Enhances the application's defense-in-depth posture by strengthening input sanitization and expanding the list of blocked disposable email domains.

Changes

Input Sanitization: Updated sanitizeInput in src/utils/security.ts to escape backticks (`) to `. This mitigates risks associated with template literal injection if data is used in JavaScript contexts.
Spam Prevention: Added 6 common disposable email domains (e.g., sharklasers.com, guerrillamail.net) to the BLOCKED_DOMAINS blocklist to reduce spam submissions.
Testing: Added unit tests in src/utils/security.test.ts to verify backtick escaping and the rejection of the new blocked domains.

Verification

Run pnpm exec vitest src/utils/security.test.ts
Verify all 13 tests pass.

Impact

Security: Reduces XSS attack surface.
UX: Prevents spam submissions, improving signal-to-noise ratio for the admin.
Risk: Low. Standard HTML escaping and targeted domain blocking.

PR created automatically by Jules for task 4718353638209319123 started by @ragusa-it

# 🛡️ Sentinel Security Enhancement ## Summary Enhances the application's defense-in-depth posture by strengthening input sanitization and expanding the list of blocked disposable email domains. ## Changes 1. **Input Sanitization**: Updated `sanitizeInput` in `src/utils/security.ts` to escape backticks (`` ` ``) to ```. This mitigates risks associated with template literal injection if data is used in JavaScript contexts. 2. **Spam Prevention**: Added 6 common disposable email domains (e.g., `sharklasers.com`, `guerrillamail.net`) to the `BLOCKED_DOMAINS` blocklist to reduce spam submissions. 3. **Testing**: Added unit tests in `src/utils/security.test.ts` to verify backtick escaping and the rejection of the new blocked domains. ## Verification - Run `pnpm exec vitest src/utils/security.test.ts` - Verify all 13 tests pass. ## Impact - **Security**: Reduces XSS attack surface. - **UX**: Prevents spam submissions, improving signal-to-noise ratio for the admin. - **Risk**: Low. Standard HTML escaping and targeted domain blocking. --- *PR created automatically by Jules for task [4718353638209319123](https://jules.google.com/task/4718353638209319123) started by @ragusa-it*

👍 1

google-labs-jules[bot] commented

2026-02-04 01:52:33 +00:00

(Migrated from github.com)

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

For security, I will only act on instructions from the user who triggered this task.

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request. When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down. I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job! For more direct control, you can switch me to **Reactive Mode**. When this mode is on, I will only act on comments where you specifically mention me with `@jules`. You can find this option in the **Pull Request** section of your [global Jules UI settings](https://jules.google.com/settings). You can always switch back! New to Jules? Learn more at [jules.google/docs](https://jules.google/docs). --- *_For security, I will only act on instructions from the user who triggered this task._*

copilot-pull-request-reviewer[bot] (Migrated from github.com) reviewed 2026-02-04 01:55:33 +00:00

copilot-pull-request-reviewer[bot] (Migrated from github.com) left a comment

Pull request overview

Strengthens Sentinel’s defense-in-depth by expanding HTML sanitization to escape backticks and by broadening the disposable email domain blocklist, with accompanying unit tests.

Changes:

Updated sanitizeInput to escape backticks as `.
Added 6 additional disposable email domains to BLOCKED_DOMAINS.
Added unit tests covering backtick escaping and some of the new blocked domains.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
`src/utils/security.ts`	Escapes backticks in `sanitizeInput` and expands the blocked disposable email domain set.
`src/utils/security.test.ts`	Adds tests for backtick escaping (including a template-literal-like payload) and verifies rejection of some newly blocked domains.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

## Pull request overview Strengthens Sentinel’s defense-in-depth by expanding HTML sanitization to escape backticks and by broadening the disposable email domain blocklist, with accompanying unit tests. **Changes:** - Updated `sanitizeInput` to escape backticks as ```. - Added 6 additional disposable email domains to `BLOCKED_DOMAINS`. - Added unit tests covering backtick escaping and some of the new blocked domains. ### Reviewed changes Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments. | File | Description | | ---- | ----------- | | `src/utils/security.ts` | Escapes backticks in `sanitizeInput` and expands the blocked disposable email domain set. | | `src/utils/security.test.ts` | Adds tests for backtick escaping (including a template-literal-like payload) and verifies rejection of some newly blocked domains. | --- 💡 <a href="/ragusa-it/ragusaitweb/new/main/.github/instructions?filename=*.instructions.md" class="Link--inTextBlock" target="_blank" rel="noopener noreferrer">Add Copilot custom instructions</a> for smarter, more guided reviews. <a href="https://docs.github.com/en/copilot/customizing-copilot/adding-repository-custom-instructions-for-github-copilot" class="Link--inTextBlock" target="_blank" rel="noopener noreferrer">Learn how to get started</a>.

src/utils/security.test.ts

copilot-pull-request-reviewer[bot] (Migrated from github.com) commented

2026-02-04 01:55:33 +00:00

The blocklist was expanded by 6 domains, but the test only asserts rejection for 3 of the newly added ones. Add assertions for the remaining new blocked domains (e.g., guerrillamail.org, guerrillamail.biz, fake-email.com) so regressions in the list are caught by CI.

The blocklist was expanded by 6 domains, but the test only asserts rejection for 3 of the newly added ones. Add assertions for the remaining new blocked domains (e.g., `guerrillamail.org`, `guerrillamail.biz`, `fake-email.com`) so regressions in the list are caught by CI.

src/utils/security.ts

						
				@@ -17,2 +17,3 @@

				    .replace(/'/g, "&#039;");

				    .replace(/'/g, "&#039;")

				    .replace(/`/g, "&#96;");

				}

copilot-pull-request-reviewer[bot] (Migrated from github.com) commented

2026-02-04 01:55:33 +00:00

sanitizeInput keeps a runtime typeof input !== "string" guard, but the function signature is input: string / returns string. This makes the guard effectively dead code for typed callers and encourages unsound usage (tests even call it with @ts-ignore). Consider either removing the non-string branch, or widening the function’s type (e.g., accept unknown) and returning a guaranteed string (via coercion) to keep the API contract consistent.

`sanitizeInput` keeps a runtime `typeof input !== "string"` guard, but the function signature is `input: string` / returns `string`. This makes the guard effectively dead code for typed callers and encourages unsound usage (tests even call it with `@ts-ignore`). Consider either removing the non-string branch, or widening the function’s type (e.g., accept `unknown`) and returning a guaranteed string (via coercion) to keep the API contract consistent.

Pull request closed

This pull request cannot be reopened because the branch was deleted.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: ragusa-it/ragusaitweb#55