Skip to content

refactor(security): drop dead escapeHtml re-export from html-sanitizer - #3288

Merged
kojiwakayama merged 1 commit into
mainfrom
fix/csrf-request-hardening
Aug 3, 2026
Merged

refactor(security): drop dead escapeHtml re-export from html-sanitizer#3288
kojiwakayama merged 1 commit into
mainfrom
fix/csrf-request-hardening

Conversation

@kojiwakayama

Copy link
Copy Markdown
Contributor

Minimal remainder of a planned security port: the CSRF and inline-script hardening scoped for this slice already landed on main via #3254 (verified byte-identical to the source branch). What remains is a verified-dead re-export: no consumer imports escapeHtml from the sanitizer (all ~20 call sites import the html-escape utils directly), the module is not re-exported by src/security/index.ts, and no export map or surface test reaches it.

Verification

deno check clean on all 12 sanitizer importers; src/security/ 78 passed (970 steps) / 0 failed; src/html/ 40 passed (671 steps) / 0 failed.

⚠️ Pushed with the local pre-push hook bypassed: current main fails test:unit in 4 unrelated react files — fix incoming as fix/react-test-gate.

The html-sanitizer module re-exported escapeHtml purely as a pass-through
from #veryfront/utils/html-escape.ts. No importer of html-sanitizer
consumes it, the security barrel does not re-export the module, and
security/client/html-sanitizer.ts is not in the deno.json exports map, so
the alias was unreachable public surface. Every escapeHtml consumer already
imports from the html-escape modules directly.
Copilot AI review requested due to automatic review settings August 2, 2026 23:03
@kojiwakayama
kojiwakayama requested a review from kwakayama as a code owner August 2, 2026 23:03
@chatgpt-codex-connector

Copy link
Copy Markdown

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Removes a verified-dead escapeHtml re-export from the client HTML sanitizer module, keeping the security surface focused on the intended sanitizer APIs and avoiding unused compatibility exports.

Changes:

  • Drop the escapeHtml import and re-export from src/security/client/html-sanitizer.ts.

Verification

  • Not run in this review environment.
  • PR description reports: deno check clean on 12 sanitizer importers; src/security/ tests 78 passed; src/html/ tests 40 passed.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@kojiwakayama
kojiwakayama enabled auto-merge August 3, 2026 00:00
@kojiwakayama
kojiwakayama added this pull request to the merge queue Aug 3, 2026
Merged via the queue into main with commit ec94136 Aug 3, 2026
30 checks passed
@kojiwakayama
kojiwakayama deleted the fix/csrf-request-hardening branch August 3, 2026 00:11
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants