From d0b69892ea158cd372f2bf0673d759db10a8ceb2 Mon Sep 17 00:00:00 2001
From: Adrian Bonpin <adrianbonpin@gmail.com>
Date: Fri, 15 May 2026 00:48:27 +0800
Subject: [PATCH] feat(security): add input sanitization to strip script tags
 and javascript: URLs from comments

---
 lib/api/comments.ts | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)

diff --git a/lib/api/comments.ts b/lib/api/comments.ts
index 7ef6cc5..ef3a81a 100644
--- a/lib/api/comments.ts
+++ b/lib/api/comments.ts
@@ -184,13 +184,32 @@ export const commentsRoutes = new Elysia({
         }
       }
 
+      // ── Sanitize: strip <script> tags and javascript: URLs from content ──
+      const sanitizeValue = (val: unknown): unknown => {
+        if (typeof val === "string") {
+          return val
+            .replace(/<script\b[^<]*(?:(?!<\/script>)<[^<]*)*<\/script>/gi, "")
+            .replace(/javascript\s*:/gi, "blocked:")
+        }
+        if (Array.isArray(val)) return val.map(sanitizeValue)
+        if (val !== null && typeof val === "object") {
+          const cleaned: Record<string, unknown> = {}
+          for (const [k, v] of Object.entries(val as Record<string, unknown>)) {
+            cleaned[k] = sanitizeValue(v)
+          }
+          return cleaned
+        }
+        return val
+      }
+      const sanitizedContent = sanitizeValue(body.content) as Record<string, unknown>
+
       const [created] = await db
         .insert(gameComments)
         .values({
           gameId: params.gameId,
           userId: guard.user.id,
           parentId: body.parentId ?? null,
-          content: body.content,
+          content: sanitizedContent,
         })
         .returning()