quoteUntrusted() does not strip HTML tags, Unicode bidi overrides, or horizontal rules

[Ashutosh0x]

Summary

quoteUntrusted() in packages/mcp-shared/src/tools.ts (L160-168) strips headings and blockquotes from server-controlled text before rendering in approval prompts, but does not strip HTML tags, Unicode bidirectional override characters, horizontal rules, or strikethrough markers.

Affected Code

defuseFences only replaces triple backticks. quoteUntrusted strips # and > at line starts but nothing else.

Missing Sanitization

Pattern	Example	Effect
HTML tags	<img src=x>, <details>	Injected markup in rendered Markdown
Unicode bidi	U+202E (RTL override)	Visually reverses text direction, misleading the approver
Horizontal rules	--- or *** at line start	Breaks visual structure of the prompt
Strikethrough	~~important warning~~	Crosses out safety-relevant text

Impact

A malicious MCP server can craft tool descriptions that include these patterns. Since the descriptions are rendered as Markdown in the Workshop chat transcript (ChatInterface.tsx uses ReactMarkdown with remarkGfm), the injected formatting can mislead the user about what a tool does.

This complements the existing issue #42 (two of the three approval-queue descriptions skip sanitizers entirely).

Suggested Fix

Add stripping for the missing patterns in quoteUntrusted():

• Strip HTML tags via regex
• Strip Unicode bidi control characters (U+200E-200F, U+202A-202E, U+2066-2069, U+061C)
• Strip horizontal rules (---/***) at line starts
• Strip strikethrough markers (~~)

Previously submitted as part of PR #66 (closed per contributing guidelines).