String Escaping/Encoding Bug Fixes

[christopherholland-workday]

Related to CodeQL findings

• 59: packages/components/nodes/sequentialagents/ExecuteFlow/ExecuteFlow.ts:202
• 61: packages/server/src/utils/buildAgentflow.ts:364
• 62: packages/server/src/utils/buildAgentflow.ts:392
• 63: packages/components/nodes/tools/Searxng/Searxng.ts:327

59, 61, 62 are not security issues, more so code smells and potential minor bugs.

For 63 we can remove our own HTML stripping because ReactMarkdown handles all of the stripping/sanitizing already.

[gemini-code-assist]

Code Review

This pull request addresses several string escaping and encoding bugs, likely identified by CodeQL. The changes primarily involve replacing single-occurrence string replacements with global regular expression-based replacements to ensure all instances of special characters are correctly handled. This is a good practice for robustness. Additionally, an HTML stripping logic in the Searxng tool has been removed, with the reasoning that ReactMarkdown already handles sanitization. This change also improves safety against potential null or undefined values. The fixes appear correct and well-targeted, though I have a suggestion to make the backslash replacement logic more robust.

[gemini-code-assist]

While using a global replacement is correct, replace(/\\/g, '') is a bit aggressive as it removes all backslashes. This could corrupt strings that are meant to contain literal backslashes (e.g., in paths).

A safer approach is to specifically un-escape only the characters that turndown escapes. According to turndown's implementation, these are: \\, *, _, [, ], (, ), #.

I suggest using a more targeted regex for this.

                const cleanNodeId = nodeIdPart.replace(/\\([\\*_\[\]()#])/g, '$1')

[gemini-code-assist]

While using a global replacement is correct, replace(/\\/g, '') is a bit aggressive as it removes all backslashes. This could corrupt strings that are meant to contain literal backslashes (e.g., in paths).

A safer approach is to specifically un-escape only the characters that turndown escapes. According to turndown's implementation, these are: \\, *, _, [, ], (, ), #.

I suggest using a more targeted regex for this.

            const cleanNodeId = variableFullPath.replace(/\\([\\*_\[\]()#])/g, '$1')