What

• Foundation PR for the input-validation hardening plan (Jira UN-3393, CWE-20 finding from external pentest L2 report, pp. 11–14).
• Adds SanitizedSerializerMixin plus pre-mixed ModelSerializer / Serializer / HyperlinkedModelSerializer under utils.serializer.sanitization, re-exported from utils.serializer. Mixin auto-attaches validate_no_html_tags to every writable CharField; opt out per-serializer via Meta.html_safe_fields = (...) for fields that legitimately accept HTML-like content (e.g. prompt text, regex literals). Read-only fields are naturally exempt (DRF skips validators on read_only=True).
• Adds structured logger.warning("input_validation_rejected", extra={"field", "reason"}) in each rejection branch of validate_no_html_tags (html_tag, js_protocol, event_handler). Searchable in logs; no metric or alert wired.
• Adds cleanup_html_payloads Django management command (under backend/commands/) — dry-run by default, --apply to redact stored pentest payloads in custom_tool.tool_name, custom_tool.description, workflow.workflow_name, workflow.description, api_deployment.display_name, api_deployment.description, adapter_instance.adapter_name.
• 14 new mixin unit tests; 36 existing test_input_sanitizer tests still pass (50 total).

Why

• External pentest (L2 report) flagged CWE-20: HTML/JS tags accepted in Prompt Studio project name, author/org, description (and equivalents on Workflow, API deployment, Adapter, Connector, Notification, Organization).
• Threat class is stored XSS. Output encoding (React JSX, Django auto-escape) is already in place as the primary defence; this PR adds a serializer-level boundary as defence-in-depth and to close the auditor's reproducer.
• Original Apr-22 proposal recommended Cloud Armor (edge WAF) as primary. Reversed to code-first after team feedback ("spawn agents to scour the codebase") and a prod scan that showed 19 stored payloads on US prod — all pentest leftovers, zero legitimate <...> content. Migration risk for forward-validation is effectively zero.
• Full decision rationale in the KB under Obsidian Vault/zipstuff/UN-3393-input-validation/ (ADRs 0001–0007).

How

• backend/utils/serializer/sanitization.py — new module. SanitizedSerializerMixin.__init__ walks self.fields, reads Meta.html_safe_fields (default ()), and appends validate_no_html_tags (bound to the field name via functools.partial) to every writable CharField's validators list. Pre-mixed ModelSerializer / Serializer / HyperlinkedModelSerializer are defined here.
• backend/utils/serializer/__init__.py — re-exports the new classes alongside the existing IntegrityErrorMixin. Consumer convention: from utils.serializer import ModelSerializer.
• backend/utils/input_sanitizer.py — adds a private _reject(field_name, reason, message) helper that logs and raises; the three rejection branches now go through it.
• backend/commands/management/commands/cleanup_html_payloads.py — uses django.apps.get_model to resolve targets at runtime (so the command doesn't fail if a pluggable app is missing). Filters by *__isnull=False and non-empty, iterates with .only(...) and .iterator(), prints id + truncated value per match, applies inside transaction.atomic() when --apply is passed.
• backend/utils/tests/test_sanitized_serializer_mixin.py — covers happy path, HTML/JS-protocol/event-handler rejection, html_safe_fields opt-out, missing Meta, read-only exemption, pre-mixed-class inheritance, raise_exception=True path.

Can this PR break any existing features. If yes, please list possible items. If no, please explain why. (PS: Admins do not merge the PR without this section filled)

• No. Nothing in backend/ imports from utils.serializer.sanitization or the new pre-mixed ModelSerializer / Serializer / HyperlinkedModelSerializer re-exports yet. Existing serializers continue to import from rest_framework import serializers and inherit serializers.ModelSerializer directly — they are unchanged.
• The structured log line added to validate_no_html_tags is emitted only when a rejection already happens (no new rejection paths) — same writes that previously got 400 still get 400, plus a single WARNING log line per rejection.
• The cleanup_html_payloads management command is opt-in; it runs only when an operator explicitly invokes it. Default mode is --dry-run (read-only).

Database Migrations

• None. No schema changes.

Env Config

• None.

Relevant Docs

• KB: Obsidian Vault/zipstuff/UN-3393-input-validation/ — INDEX, threat model, target architecture, rollout plan, prod baseline, ADRs 0001–0007.

Related Issues or PRs

• Jira: UN-3393
• Follow-up sweep PR (PR2): rewrites from rest_framework import serializers to from utils.serializer import ... across backend/ + backend/pluggable_apps/, deletes the redundant manual validate_<field> methods in the 8 serializers already covered, adds Meta.html_safe_fields opt-outs as needed.

Dependencies Versions

• None.

Notes on Testing

• New + existing tests:
  cd backend && uv run pytest utils/tests/test_sanitized_serializer_mixin.py utils/tests/test_input_sanitizer.py -q
  → 50 passed.
• Manual: import sanity check — python -c \"from utils.serializer import ModelSerializer, Serializer, HyperlinkedModelSerializer, SanitizedSerializerMixin; print('ok')\".
• Manual: dry-run the cleanup command on a populated dev DB — python manage.py cleanup_html_payloads — should print candidate rows without making changes.

Screenshots

n/a (no UI change)

Checklist

I have read and understood the Contribution Guidelines.