security: input validation & injection fixes (XSS, constantize, open redirects, CSV, SQL)#1517

Open

dgilperez wants to merge 11 commits into

we-promise:mainfrom

dgilperez:security/pr1-input-validation

Commits on Apr 19, 2026

fix(security): sanitize markdown output to prevent stored XSS (FIX-05, HIGH-04)
dgilperez
committed
fix(security): sanitize GitHub release notes in changelog (FIX-06)
dgilperez
committed
fix(security): allowlist class names in import mappings controller (FIX-07)
dgilperez
committed
fix(security): sanitize return_to to prevent open redirect (FIX-08)
dgilperez
committed
fix(security): allowlist accountable types in AccountImport (F-07)
dgilperez
committed
fix(security): escape CSV formula injection in family data export (F-09)
dgilperez
committed
fix(security): sanitize account return_to redirect (F-10)
dgilperez
committed
fix(security): eliminate SQL interpolation in reports ORDER BY (CRIT-02)
dgilperez
committed
fix(security): escape LIKE wildcards in API transactions search (HIGH-03)
dgilperez
committed
fix(security): filter raw HTML in guides markdown renderer (HIGH-05)
dgilperez
committed
fix(security): address CodeRabbit review
dgilperez
committed