Original task: Executive Meetings — test coverage + sanitization
closeout (umbrella for #170, #186-189, #201, #202, #212, #214, #218,
#235).
What landed
- Added `stripTagsToPlainText[OrNull]` in
`artifacts/api-server/src/lib/sanitize.ts`. Implementation is a
two-pass regex stripper (NOT sanitize-html + entity decode):
Pass 1: drop dangerous tag bodies entirely
(`<script>`/`<style>`/`<noscript>`/`<iframe>`/`<object>`/
`<embed>`/`<template>` content + tags).
Pass 2: strip HTML comments, CDATA, DOCTYPE, processing
instructions, and any remaining open/close tags via
`<\/?[a-zA-Z][^>]*>`.
No entity decode pass — so URLs (`?a=1&b=2`) round-trip unchanged,
plain text (`5 < 10`) is preserved, AND attacker-supplied encoded
payloads (`<script>…`) survive as inert text instead of being
rehydrated into live tags. The existing `sanitizePlainText` (which
entity-encodes) is preserved for `attendee.title` so the print
template's HTML interpolation behavior is unchanged.
- Wired the new helper into all 11 write paths for
`location`/`meetingUrl`/`notes` in
`artifacts/api-server/src/routes/executive-meetings.ts`:
POST /executive-meetings, PATCH /executive-meetings/:id,
POST /executive-meetings/:id/duplicate, and `applyApprovedRequest`
(`change_location` + `note`). attendee.title call sites kept as-is.
- Added 6 API tests in
`artifacts/api-server/tests/executive-meetings.test.mjs`:
1. POST sanitization (URL `&` round-trip + literal `<`/`&` in notes
+ asserts NO entity-encoding in stored values).
2. Encoded-payload regression guard (`<script>`,
`<script>`, mixed-case `<ScRiPt>`/`<IFRAME>`)
confirming we don't decode entities into live tags.
3. PATCH sanitization on the same fields.
4. Duplicate-path round-trip (URL ampersands preserved).
5. change_location approved-request round-trip + tag stripping.
6. EditableCell column-independence contract test (PATCH titleEn
alone must not clobber titleAr and vice versa).
Drift from the original umbrella
- The umbrella also listed 9 Playwright e2e specs (#170, #186, #187,
#188, #201, #212, #214, #218, #235). Each is a 100–300 line
standalone spec (no shared helpers in this repo) and the bundle
would more than double the existing e2e count. Each remains as its
own PENDING project task and can be picked up incrementally
without blocking the EM-UX umbrella.
Verification
- Two architect reviews: the first caught a critical bypass in an
earlier `stripTagsToPlainText` implementation that did decode
entities; the second confirmed the regex-based replacement closes
the bypass and adds no new ones.
- Suite: 226 tests, 224 passing. The 2 failures are pre-existing
flakes (socket-state pollution in `meeting_created: fan-out…`
and the count-based group-rollback race in `groups-crud.test.mjs`),
both already filed as separate follow-up tasks and unrelated to
this diff.
- Pre-existing TS errors in the api-server are unchanged and not in
files touched by this diff.
riyadhafraa
8b6eed1e59