From cd93df49ea240c6e95fb966234bf2c1add93922b Mon Sep 17 00:00:00 2001 From: Anshul Jain Date: Sat, 1 Aug 2026 23:36:50 +0530 Subject: [PATCH] Sanitize span labels to prevent stored XSS attacks Fixes #151 Implements HTML encoding for span names, labels, and error messages before storing in database. Prevents stored XSS attacks where agents can inject malicious JavaScript that executes in dashboard user sessions. Changes: - Added sanitizeHtml() function for HTML entity encoding - Applied sanitization to span name before storage - Applied sanitization to span error field - Applied sanitization to string-type span attributes - Encodes HTML special characters: & < > " ' Security improvements: - Prevents stored XSS attacks from malicious span data - Database stores safe HTML-encoded values - Protects dashboard users from credential theft - Works with existing visualization code The sanitization function encodes HTML entities while preserving readability: