ragusa-it/ragusaitweb
1
0
Fork 0
Code Issues Pull Requests 6 Actions Packages Projects Releases Wiki Activity

🛡️ Sentinel: [Enhancement] Harden input sanitization and expand blocked domains #55

Closed
ragusa-it wants to merge 1 commits from sentinel/security-enhancements-4718353638209319123 into main
pull from: sentinel/security-enhancements-4718353638209319123
merge into: ragusa-it:main
Conversation 2 Commits 1 Files Changed 2 +16 -1
2 changed files with 16 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
src/utils/security.test.ts
View File

@@ -10,6 +10,7 @@ describe('Security Utils', () => {
expect(sanitizeInput('foo & bar')).toBe('foo & bar');
expect(sanitizeInput('"quotes"')).toBe('"quotes"');
expect(sanitizeInput("'single quotes'")).toBe(''single quotes'');
expect(sanitizeInput('`backticks`')).toBe('`backticks`');
expect(sanitizeInput('>')).toBe('>');
});
@@ -25,6 +26,10 @@ describe('Security Utils', () => {
const expected = '<script>alert("XSS")</script>';
expect(sanitizeInput(input)).toBe(expected);
});
it('escapes template literal injection vectors', () => {
expect(sanitizeInput('`${alert(1)}`')).toBe('`${alert(1)}`');
});
});
describe('isValidEmail', () => {
@@ -74,6 +79,9 @@ describe('Security Utils', () => {
expect(isValidEmail('spam@mailinator.com')).toBe(false);
expect(isValidEmail('bot@yopmail.com')).toBe(false);
expect(isValidEmail('temp@temp-mail.org')).toBe(false);
expect(isValidEmail('spam@sharklasers.com')).toBe(false);
expect(isValidEmail('spam@guerrillamail.net')).toBe(false);
expect(isValidEmail('spam@dispostable.com')).toBe(false);
});
it('rejects blocked domains regardless of case', () => {

9
src/utils/security.ts
View File

@@ -14,7 +14,8 @@ export function sanitizeInput(input: string): string {
.replace(/</g, "&lt;")
.replace(/>/g, "&gt;")
.replace(/"/g, "&quot;")
.replace(/'/g, "&#039;");
.replace(/'/g, "&#039;")
.replace(/`/g, "&#96;");
}
copilot-pull-request-reviewer[bot] commented 2026-02-04 01:55:33 +00:00 (Migrated from github.com)
Review
Copy Link

sanitizeInput keeps a runtime typeof input !== "string" guard, but the function signature is input: string / returns string. This makes the guard effectively dead code for typed callers and encourages unsound usage (tests even call it with @ts-ignore). Consider either removing the non-string branch, or widening the function’s type (e.g., accept unknown) and returning a guaranteed string (via coercion) to keep the API contract consistent.

`sanitizeInput` keeps a runtime `typeof input !== "string"` guard, but the function signature is `input: string` / returns `string`. This makes the guard effectively dead code for typed callers and encourages unsound usage (tests even call it with `@ts-ignore`). Consider either removing the non-string branch, or widening the function’s type (e.g., accept `unknown`) and returning a guaranteed string (via coercion) to keep the API contract consistent.
// Common disposable email providers and invalid domains
@@ -27,6 +28,12 @@ const BLOCKED_DOMAINS = new Set([
"guerrillamail.com",
"10minutemail.com",
"trashmail.com",
"sharklasers.com",
"guerrillamail.net",
"guerrillamail.org",
"guerrillamail.biz",
"dispostable.com",
"fake-email.com",
]);
/**