Prompt content previews need sandboxing for markdown, links, and embedded media

[prissca]

Problem

Creator-provided preview content can introduce XSS, unsafe links, tracking pixels, or layout-breaking payloads.

Scope

• Sanitize preview markdown and rich text
• Restrict unsafe links and embeds
• Add security regression tests

Acceptance criteria

• Scripts and unsafe URLs are neutralized
• Allowed markdown renders correctly
• Tests cover XSS, iframes, images, and long content

Relevant areas

• src/pages/prompts
• src/pages/sell
• server/tests

Complexity

High - 200 points

Contributor guidance

Start with a short design note in the issue discussion, then implement with focused tests and documentation for the affected workflow.

[malaysiaonelove]

Hi maintainer, I’m interested in working on this issue. I have relevant experience and have reviewed the requirements. Please assign it to me I’m confident I can deliver a high-quality solution.

[Ranjeet2063]

Hello! I'd like to work on this issue.

Execution Plan for Prompt content previews need sandboxing for markdown, links, and embedded media:

• Clean Implementation: Deliver an idiomatic solution for Prompt content previews need sandboxing for markdown, links, and embedded media adhering strictly to Prompt-Hash-Stellar/prompt-hash's architecture.
• Automated Tests: Provide full test coverage asserting both edge cases and core workflows.
• Clean Git Hygiene: Atomic conventional commits with zero merge conflicts.

Why assign me?

• Proven Proof-of-Work: ci(deps): bump actions/upload-artifact from 3 to 7 #1 contributor on Mova Store (28 merged Web3 PRs) and official ElizaOS contributor.
• Fast Turnaround: Dedicated to shipping a tested, production-grade PR within 12–24 hours.
• Zero Maintainer Burden: Self-documenting code with green CI and tests included so you don't spend time debugging.

Ready to deliver within 12–24h—please feel free to assign it to me!

[ZacLou]

Design note: I’ll sanitize preview input at the rendering boundary with an allowlist-first policy. Markdown will allow only supported formatting; links will be restricted to http/https and rel/target hardened; scripts, iframes, event handlers, javascript/data URLs, and unknown embeds will be removed. I’ll add regression tests for XSS payloads, unsafe URLs, iframe/image embeds, long content, and allowed-markdown rendering, then verify the existing prompt and sell workflows.

[s6pa1rta3n-lab]

Design note:

• Sanitize preview markdown and rich text content at the preview rendering boundary using an allowlist policy.
• Strip unsafe protocols (e.g., javascript:, data:), inline event handlers, scripts, and unvetted iframes/embeds.
• Enforce hardened anchor attributes (rel="noopener noreferrer nofollow" and safe external target handling).
• Provide unit and security regression test suites covering XSS payloads, unsafe links, iframe/embed sanitization, and layout/length constraints across prompt and sell preview workflows.

[guptakumarranjeet150]

Hello! I'd like to work on this issue.

I can tackle Prompt content previews need sandboxing for markdown, links, and embedded media. Proposed implementation roadmap:

• Analysis: Inspect current behavior and edge cases in Prompt-Hash-Stellar/prompt-hash
• Implementation: Deliver a clean, modular solution for Prompt content previews need sandboxing for markdown, links, and embedded media strictly following Prompt-Hash-Stellar/prompt-hash conventions.
• Testing: Cover changes with automated tests ensuring CI passes smoothly.
• PR: Atomic commit with clean git hygiene and passing CI

I am ready to start immediately—please assign this to me!

[ranjeet150]

Hello @maintainers,

I would like to resolve this issue. Here is my proposed execution plan:

• Implementation: Deliver a clean, modular solution for Prompt content previews need sandboxing for markdown, links, and embedded media strictly following Prompt-Hash-Stellar/prompt-hash conventions.
• Testing & Verification: Cover changes with automated tests ensuring CI passes smoothly.
• Delivery: Ready to ship a thoroughly tested PR within 12–24 hours with passing CI.

Looking forward to contributing—please feel free to assign!