fix(ui): escape dynamic HTML in dashboard and memory views

[pawanrahul370-commits]

Related to #770

Summary

• Escapes dynamic agent/session metadata, memory metadata, RAG source titles, and UI error messages before inserting them into innerHTML.
• Moves the Forget action memory id into a data-memory-id attribute to avoid inline JavaScript string interpolation.
• Adds a static regression test that guards the UI against reintroducing these raw HTML interpolations.

Reproduction

1. Create or return agent/memory metadata containing HTML markup, for example in an agent description, memory provenance/source/status/type, or answer source title.
2. Open the Memanto local UI pages that render those values through dashboard, playground, explorer, history, config, or analytics views.
3. Before this patch, several of those values were interpolated directly into innerHTML. After this patch, they render as text via escHtml(...) or safe data attributes.

Tests

• python -m pytest tests/test_ui_static_xss.py
• python -m pytest tests/test_ui_auth.py tests/test_remaining_ui_auth.py

Summary by CodeRabbit

• Bug Fixes

  • Improved dashboard, explorer, playground, and history views to safely display dynamic content and error messages.
  • Prevented untrusted HTML from being interpreted in agent details, memory sources, metadata, and server responses.
  • Improved memory row actions to reliably target the selected memory.

• Tests

  • Added regression coverage verifying that dynamic UI content is properly escaped.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ff9f9612-0170-44f1-82ab-ee5b8d685394

📥 Commits

Reviewing files that changed from the base of the PR and between 5c3f06c and 7bd6ae4.

📒 Files selected for processing (2)

• memanto/app/ui/static/index.html
• tests/test_ui_static_xss.py

---

📝 Walkthrough

Walkthrough

The UI now escapes dynamic dashboard, playground, explorer, memory-table, and error content before HTML insertion. Static regression tests verify escaped expressions and the revised memory action wiring.

Changes

UI HTML Escaping Hardening

Layer / File(s)	Summary
Dashboard and playground escaping memanto/app/ui/static/index.html, tests/test_ui_static_xss.py	Agent/session fields and RAG source text are escaped before rendering, with regression assertions for dashboard and source templates.
Memory table rendering and actions memanto/app/ui/static/index.html, tests/test_ui_static_xss.py	Memory metadata uses escaped output, and the Forget action reads its identifier from data-memory-id; regression coverage checks these templates.
Error message escaping memanto/app/ui/static/index.html, tests/test_ui_static_xss.py	Recall, Explorer, History, Configuration, and Analytics error messages escape exception text before rendering, with matching regression assertions.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: het0814

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly matches the main UI hardening change: escaping dynamic HTML in dashboard and memory views.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}