fix: remediate Cross-Site Scripting (XSS) vulnerabilities (Snyk SAST)

[devin-ai-integration]

Summary

Sanitizes the user_id path parameter using django.utils.html.escape() in two view functions flagged by Snyk Code (SAST) for XSS (python/XSS):

• register_approve — POST /users/{user_id}/register/approve
• register_deny — POST /users/{user_id}/register/deny

The user_id string from the URL is now HTML-escaped before being passed to downstream functions (approve_user_registration, deny_user_registration). Since valid UUIDs contain only hex characters and dashes, escape() is a no-op for legitimate inputs but neutralizes any injected HTML/JS in malformed requests.

Review & Testing Checklist for Human

• Verify escape() interaction with is_valid_uuid(): The downstream functions validate UUID format. Confirm that django.utils.html.escape() returning a SafeString (subclass of str) doesn't cause is_valid_uuid() to behave differently.
• log_action decorator on register_approve still receives the raw user_id: The decorator's lambda captures user_id before escape() runs inside the function body. Verify this is acceptable — the lambda passes it to get_user_sync() which does a DB lookup, so XSS risk there is low, but worth confirming.
• Test both endpoints manually: Call POST /users/{user_id}/register/approve and POST /users/{user_id}/register/deny with (a) a valid UUID and (b) a string containing <script> tags to confirm the fix works and valid requests still succeed.

Notes

• escape() on a valid UUID is a no-op, so existing functionality is preserved for all legitimate requests.
• The register_deny endpoint does not have a log_action decorator, so it is fully covered by this fix.
• CI failures for frontend (npm audit vulnerabilities), bandit (environment import crash), and security/snyk (Colhodm) (rate limit) are all pre-existing and unrelated to this change. The backend, backend_python, and docs checks pass.

Link to Devin session: https://app.devin.ai/sessions/95f6f29c14304cbb894ce2d9f4485fae
Requested by: @joao-cognition

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring