chore(opencode): consolidate escape logic (#32360)

packages/opencode/test/plugin/codex.test.ts

@@ -4,6 +4,7 @@ import {
   parseJwtClaims,
   extractAccountIdFromClaims,
   extractAccountId,
+  renderOAuthError,
   type IdTokenClaims,
 } from "../../src/plugin/openai/codex"
 
@@ -14,6 +15,14 @@ function createTestJwt(payload: object): string {
 }
 
 describe("plugin.codex", () => {
+  test("escapes provider errors in callback HTML", () => {
+    const error = `</div><script>alert("xss" & 'more')</script>`
+    const html = renderOAuthError(error)
+
+    expect(html).toContain("&lt;/div&gt;&lt;script&gt;alert(&quot;xss&quot; &amp; &#39;more&#39;)&lt;/script&gt;")
+    expect(html).not.toContain(error)
+  })
+
   describe("parseJwtClaims", () => {
     test("parses valid JWT with claims", () => {
       const payload = { email: "test@example.com", chatgpt_account_id: "acc-123" }

packages/opencode/test/plugin/xai.test.ts

@@ -2,7 +2,6 @@ import { describe, expect, test } from "bun:test"
 import {
   accessTokenIsExpiring,
   buildAuthorizeUrl,
-  escapeHtml,
   pollDeviceCodeToken,
   requestDeviceCode,
   XaiAuthPlugin,
@@ -103,19 +102,6 @@ describe("plugin.xai", () => {
     })
   })
 
-  describe("escapeHtml", () => {
-    test("escapes HTML metacharacters", () => {
-      expect(escapeHtml(`</div><script>alert(1)</script><div class="x">`)).toBe(
-        "&lt;/div&gt;&lt;script&gt;alert(1)&lt;/script&gt;&lt;div class=&quot;x&quot;&gt;",
-      )
-      expect(escapeHtml("a & b")).toBe("a &amp; b")
-      expect(escapeHtml("it's fine")).toBe("it&#39;s fine")
-      expect(escapeHtml("invalid_grant")).toBe("invalid_grant")
-      expect(escapeHtml("")).toBe("")
-      expect(escapeHtml("&<")).toBe("&amp;&lt;")
-    })
-  })
-
   describe("loader", () => {
     test("returns no options unless stored auth is OAuth and exposes methods in order", async () => {
       const hooks = await XaiAuthPlugin({} as any)

packages/opencode/test/util/html.test.ts

@@ -0,0 +1,15 @@
+import { describe, expect, test } from "bun:test"
+import { escapeHtml } from "../../src/util/html"
+
+describe("escapeHtml", () => {
+  test("escapes HTML metacharacters", () => {
+    expect(escapeHtml(`</div><script>alert(1)</script><div class="x">`)).toBe(
+      "&lt;/div&gt;&lt;script&gt;alert(1)&lt;/script&gt;&lt;div class=&quot;x&quot;&gt;",
+    )
+    expect(escapeHtml("a & b")).toBe("a &amp; b")
+    expect(escapeHtml("it's fine")).toBe("it&#39;s fine")
+    expect(escapeHtml("invalid_grant")).toBe("invalid_grant")
+    expect(escapeHtml("")).toBe("")
+    expect(escapeHtml("&<")).toBe("&amp;&lt;")
+  })
+})