Pull Request Overview

Adds a custom WebAuthn registration form that sanitizes device names to prevent XSS and wires it into the application’s security settings.

• Introduces SanitizedWebAuthnRegisterForm with validation and sanitization logic for the name field.
• Imports sanitize_string and integrates ValidationError for consistent error handling.
• Configures the new form under Flask-Security options in app.py.

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

    def validate_name(self, field):

Can we do 2 modifications :

1. I don't like the current Silent modification UX, Users get no feedback when HTML is stripped, creating confusion. Let's raise a validation error if the input is not valid or contains HTML (explicit rejection)

2. for this use case as mentioned in the comment, we can't use the sanitize string, Let's instead build a custom method or util to validate and reject :

• html tags
• html entities
• complex nested html
• long strings

here is an example

if not field.data or not field.data.strip():
        raise ValidationError("Device name cannot be empty.")
    
    import re
    from html import unescape
    
    # Reject HTML tags
    if re.search(r'<[^>]*>', field.data):
        raise ValidationError(
            "Device name cannot contain HTML tags. Please enter plain text only."
        )
    
    # Reject HTML entities
    if unescape(field.data) != field.data:
        raise ValidationError(
            "Device name cannot contain HTML entities. Please enter plain text only."
        )
    
    # Normalize whitespace and validate length
    clean_name = ' '.join(field.data.split())
    if len(clean_name) > 64:
        raise ValidationError("Device name is too long (maximum 64 characters).")

example cases to be rejected :

[
    "My <script>alert('xss')</script> Phone",
    "Device &lt;script&gt;",
    "Phone<!--comment-->",
    "My <div>Phone</div>",
    "&amp;Device&amp;",
    "Phone<svg onload=alert()>"
]

• also very long strings

we can re-use this util method everywhere we need (feel free to parameterize it with string length etc .. )

Excellent. All boxes checked ✅