[E04-S04-T03] HTML injection attempts remain text #230

New Issue

2026-08-27T00:14:56Z

kpcto commented

2026-08-27 00:14:56 +00:00

Parent story: [E04-S04] Initial blocks (#71)

Intent

Keep HTML injection attempts as plain text unless supported via the safe rich-text model.

Acceptance criteria

HTML injection attempts remain plain text in rendered output.
Only the safe rich-text model may emit markup.

Explicitly out of scope

Unknown block fallback (E04-S04-T02).

Test plan

A test injects HTML and asserts it is escaped as text.

Rollback note

Rendering change; revert restores prior output.

Owning stream

platform

Risk quadrant

agent-full

> Parent story: [E04-S04] Initial blocks (#71) ## Intent Keep HTML injection attempts as plain text unless supported via the safe rich-text model. ## Acceptance criteria - HTML injection attempts remain plain text in rendered output. - Only the safe rich-text model may emit markup. ## Explicitly out of scope - Unknown block fallback (E04-S04-T02). ## Test plan - A test injects HTML and asserts it is escaped as text. ## Rollback note - Rendering change; revert restores prior output. ### Owning stream platform ### Risk quadrant agent-full

kpcto added this to the Sprint 1 milestone 2026-08-27 00:14:56 +00:00

kpcto added the

labels 2026-08-27 00:14:56 +00:00

Sign in to join this conversation.