fix(security): complete sanitization in reporter (CodeQL js/incomplete-sanitization)

[williamzujkowski]

Summary

Fixes the HIGH CodeQL js/incomplete-sanitization alerts (both instances at src/reporter.ts:56).

markdownCell() escaped newlines and the | markdown table delimiter, but never escaped the backslash it uses as the escape character. The sanitization was therefore incomplete:

• an input \| survived unescaped (the | regex saw an already-prefixed backslash and produced \\|-shaped ambiguity), and
• a trailing \ in a cell value could escape the real | column delimiter the formatter appends, breaking out of the table cell.

Before / After

Before:

return value.replace(/\r?\n/g, ' ').replace(/\|/g, '\\|');

After:

return value
  .replace(/\\/g, '\\\\')   // escape backslash FIRST
  .replace(/\r?\n/g, ' ')
  .replace(/\|/g, '\\|');

Escaping the backslash first means the escapes we add can no longer be re-introduced or neutralized by input data. All three replacements are global, so every occurrence is handled.

Test (RED -> GREEN)

Added fully escapes every pipe and pre-existing backslash so the cell cannot break out in src/reporter.test.ts: input with multiple pipes (a|b|c), embedded backslashes (C:\tmp\x), an already-escaped \|, and a trailing \. Asserts every pipe/backslash is fully escaped and the row splits into exactly the 4 table columns. Verified it FAILS on the pre-fix code and PASSES with the fix.

Gates

• npm run build (tsc): pass
• npm test (vitest): 65/65 pass
• No lint script in package.json (nothing to run).

🤖 Generated with Claude Code