SLCORE-1144 Fix SSF-699

[nquinquenel]

SLCORE-1144

[damien-urruty-sonarsource]

It would be interesting to check if there are other Unicode problematic characters. Also should the fix be applied to other inputs received by the embedded server?

[nquinquenel]

It would be interesting to check if there are other Unicode problematic characters.

There are many documentation (OWASP, unicode.org), on this subject, and I feel like there is no easy and straightforward solution regarding Unicode validation. Depending on what kind of text we expect, we could allow or disallow many things; the risk is that you could have false positives that would break the AI-generated code. I'm not strongly opinionated, but I'd tend to go easy for now on the validation.

[sonarqube-next]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
100.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube

[nquinquenel]

Also should the fix be applied to other inputs received by the embedded server?

The only inputs received by the embedded server that are shown to the client are the fix suggestions and the branch names in some notification titles. I think the only attack vector is when showing and applying a fix suggestion.