Manish Gupta 0d58adb69d [WEB-7774] fix(security): sanitize comment_html and intake description_html with nh3 (#9287) ...

GHSA-6qrq-f73q-r67j / GHSA-j9pv-f5wm-p4g2 — IssueCommentSerializer in
both app and api layers stored comment_html without sanitization. The app
layer had no validate() at all; the api layer only ran lxml structural
normalization which does not strip XSS payloads.

Fix: both serializers now call validate_html_content() (nh3-backed) in
their validate() methods, replacing the raw value with sanitized HTML.

GHSA-hh2r-3hwp-mvq3 — space/views/intake.py and api/views/intake.py
both used bare Issue.objects.create() with description_html taken
directly from request data, bypassing any serializer validation.

Fix: both paths now call validate_html_content() and pass the sanitized
value to Issue.objects.create(). Falls back to "<p></p>" if sanitizer
returns None (empty/invalid input).

The nh3 sanitizer (validate_html_content in content_validator.py) was
already present and used by IssueCreateSerializer — this change extends
coverage to the two remaining unsanitized comment and intake paths.

Co-authored-by: Plane AI <noreply@plane.so>

2026-06-23 17:52:31 +05:30

..

bin

…

plane

[WEB-7774] fix(security): sanitize comment_html and intake description_html with nh3 (#9287)

2026-06-23 17:52:31 +05:30

requirements

…

templates

…

tests

…

.coveragerc

…

.env.example

…

.prettierignore

…

Dockerfile.api

…

Dockerfile.dev

…

manage.py

…

package.json

…

pyproject.toml

…

pytest.ini

…

requirements.txt

…

run_tests.py

…

run_tests.sh

…