sanitizePlainText (sanitize.ts)

Simple, dependency-free sanitizers for user-provided text. Goal: prevent stored XSS / weird control characters, keep payload sizes reasonable.

// Simple, dependency-free sanitizers for user-provided text.
// Goal: prevent stored XSS / weird control characters, keep payload sizes reasonable.

export function sanitizePlainText(input: unknown, opts?: { maxLen?: number }): string {
  const maxLen = opts?.maxLen ?? 5000;
  const s = String(input ?? "");

  // Remove NUL and other control chars (keep \n and \t).
  const noCtl = s.replace(/[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/g, "");

  // Collapse CRLF to LF and trim.
  const normalized = noCtl.replace(/\r\n?/g, "\n").trim();

  if (normalized.length <= maxLen) return normalized;
  return normalized.slice(0, maxLen);
}

export function sanitizeTag(input: unknown): string {
  // tags are used in search/filter; keep them predictable.
  const s = sanitizePlainText(input, { maxLe

... (truncated -- full source via MCP)