Security: Reflected/stored XSS via unsanitized HTML interpolation in search results

[tuanaiseo]

Problem

User-controlled and model-controlled values are directly interpolated into HTML (final_answer, rawText, metadata, filename, titleMetadata, documentDate) and returned with c.html(...) without output encoding. An attacker can inject <script> or event-handler payloads through query inputs or upstream content and execute JavaScript in victim browsers.

Severity: high
File: JS/edgechains/lib/create-edgechains/__common/src/routes/hydeSearch.route.ts

Solution

HTML-escape all dynamic fields before interpolation, or render using a templating system with auto-escaping. Additionally apply a strict CSP and avoid returning raw concatenated HTML strings.

Changes

• JS/edgechains/lib/create-edgechains/__common/src/routes/hydeSearch.route.ts (modified)

Testing

• Existing tests pass
• Manual review completed
• No new warnings/errors introduced

[github-actions]

CLA Assistant Lite bot: Thank you for your submission, we really appreciate it. Before we can accept your contribution, we ask that you sign the Arakoo Contributor License Agreement. You can sign the CLA by adding a new comment to this pull request and pasting exactly the following text.

---

I have read the Arakoo CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request}