Sanitize form inputs: trim whitespace and escape HTML (client + server-side)

[Copilot]

Form Input Sanitization - Complete ✅

• Analyze the codebase to understand form handling
• Identify all form input fields (callsign, my_locator, filename)
• Review existing sanitization (my_locator already has .strip())
• Create a centralized input sanitization utility function
• Apply trimming to callsign field
• Ensure consistent sanitization across all text inputs
• Add tests for whitespace trimming on all fields
• Add tests to verify XSS protection (HTML escaping)
• Run existing tests to ensure no regressions
• Run linter to verify code quality - all clean
• Run security scanner (CodeQL) - 0 alerts
• Address code review feedback
• Use Markup from Flask and | safe filter per reviewer request
• Apply sanitization to ALL user-provided variables including filename
• Add client-side JavaScript auto-trim for better UX

Implementation Summary:

Created sanitize_text_input() function in qsomap/upload.py that:

• Trims leading/trailing whitespace (spaces, tabs, newlines)
• Escapes HTML characters using Markup.escape() to prevent XSS
• Returns Markup objects (not strings) to prevent double-escaping
• Returns None for empty/whitespace-only strings

Applied sanitization to ALL user-provided text inputs:

• callsign field (server + client-side)
• my_locator field (server + client-side)
• filename field (server-side only)

Template changes:

• Added | safe filter to {{ callsign }} and {{ filename }} in qso_list.html
• Markup objects are already safe, so Jinja2 won't double-escape them
• Added JavaScript in main.html to auto-trim callsign and locator fields on the browser side

Client-Side Enhancement:

Added JavaScript to automatically trim whitespace from form fields for better user experience:

• Trims on blur event (when user leaves field) for immediate visual feedback
• Trims on form submit as final safety check before sending to server
• Prevents common frustration with mobile keyboards auto-adding trailing spaces
• Works in conjunction with server-side sanitization (defense in depth)

Testing Results:
✅ All 14 input sanitization tests pass (including new filename test)
✅ All 9 existing Flask tests pass
✅ All 23 tests pass with 0 linting errors
✅ CodeQL security scan: 0 alerts
✅ Code review: all feedback addressed

Security:

• Defense-in-depth approach: client-side trim + server-side HTML escaping via Markup + explicit | safe in templates
• XSS attempts are neutralized by converting special characters to HTML entities
• No double-escaping issues - Markup objects signal to Jinja2 that content is already safe
• ALL user-provided text variables are now sanitized (callsign, my_locator, filename)
• Client-side trimming improves UX without compromising security (server still validates and sanitizes)

Original prompt

---

This section details on the original issue you should resolve

<issue_title>Obcinanie spacji w formularzu</issue_title>
<issue_description>Dobrze by było, aly formularz obcinał spacje/inne białe znaki w polach formularza. Na końcu i początku stringów.
Chrome / klawiatura na Androidzie wstawiło mój lokator "z pamięci", ale na końcu była spacja (może to klawiatura na telefonie dodaje automatycznie) i dostałem błąd, że nieprawidłowa forma.
Pierdoła, ale byłoby miło. No i czy tam inną sanityzację przetwarzanych tekstów masz?</issue_description>

<agent_instructions>Clean inserted text from form to avoid XSS or other potential security issue</agent_instructions>

Comments on the Issue (you are @copilot in this section)

• Fixes Obcinanie spacji w formularzu #12

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[quamilek]

@copilot use | safe tag in all variables provided by user.
Use also Markup from flask framework

[quamilek]

@copilot use | safe tag in all variables provided by user.
Use also Markup from flask framework

[quamilek]

@copilot use | safe tag in all variables provided by user.
Use also Markup from flask framework

[Copilot]

@copilot use | safe tag in all variables provided by user.
Use also Markup from flask framework

Done. Updated sanitize_text_input() to return Markup objects instead of strings, and added | safe filter to user-provided variables in the template (callsign and filename). This prevents double-escaping while maintaining XSS protection.

Commit: 9121ee6

[Copilot]

@copilot use | safe tag in all variables provided by user.
Use also Markup from flask framework

Completed. All user-provided variables now use Markup and | safe filter. Added sanitization for the filename variable which was previously missing.

Commit: 9f0358c

@copilot use | safe tag in all variables provided by user.
Use also Markup from flask framework

Completed. All user-provided variables now use Markup and | safe filter. Added sanitization for the filename variable which was previously missing.

Commit: 9f0358c

[quamilek]

@copilot Add automatic strip string to remove white characters on start and end call and locator field in form. Do it on the browser side in java script code

[Copilot]

@copilot Add automatic strip string to remove white characters on start and end call and locator field in form. Do it on the browser side in java script code

Done. Added JavaScript to automatically trim whitespace from callsign and locator fields on the browser side. The trimming happens:

• When user leaves the field (blur event) for immediate feedback
• On form submit as a final safety check

This complements the existing server-side sanitization and provides better UX, especially for mobile users.

Commit: f616ade