backup

Docs/Tasks.md

@@ -1,24 +0,0 @@
-### Issue #69: LOW - Jail Names Echoed in Error Messages Without Sanitization
-
-**Where found**:
-- `backend/app/exceptions.py:138,351` – jail names interpolated directly into error strings
-
-**Why this is needed**:
-Although Python's `repr()` provides basic escaping, user-supplied jail names are reflected back in error messages. If these messages are ever rendered in an HTML context (e.g., a future admin UI or email notification), they become XSS vectors. They also act as confirmation oracles when combined with timing attacks.
-
-**Goal**:
-Error messages referencing user input are sanitized before inclusion.
-
-**What to do**:
-1. Pass user-supplied values through a dedicated `sanitize_for_display()` helper before interpolation.
-2. Ensure the helper strips or escapes HTML special characters.
-3. For API responses, always return the original (validated) field name rather than the raw user input.
-
-**Possible traps and issues**:
-- Over-escaping in JSON responses is not needed (JSON is not HTML); apply sanitization only at HTML render boundaries.
-
-**Docs changes needed**:
-- `CONTRIBUTING.md`: document the rule that user input must not be echoed raw in messages.
-
-**Doc references**:
-- `backend/app/exceptions.py`