fix: don't HTML-escape quotes/apostrophes in plain-text article/ticket content

[snizzleorg]

Summary

• ArticleCreate.sanitize_body (for text/plain articles added via zammad_add_article) and TicketCreate.sanitize_html (title + initial article body via zammad_create_ticket) both called html.escape() with its default quote=True, which turns ' into ' and " into ".
• That's intended as defense-in-depth against HTML injection, but plain-text content is sent/stored verbatim by Zammad (e.g. in outbound emails) — there's no HTML decoding step downstream. The result: ordinary apostrophes like "we've"/"you'd" show up literally as ' in the actual sent email, even though content_type is text/plain (the default).
• Fix: keep escaping <, >, & for defense-in-depth, but stop escaping quotes (html.escape(v, quote=False)) for plain-text content.

Test plan

• uv run pytest — full suite passes (222 passed)
• uv run ruff check / uv run mypy — clean
• Updated existing tests (test_html_sanitization_in_title, test_html_sanitization_in_body in both tests/test_models.py and the ArticleCreate equivalent in tests/test_server.py) to assert quotes are preserved while </> remain escaped

Summary by CodeRabbit

• Bug Fixes
  • Improved sanitization when creating tickets and articles in plain-text format.
  • Quotation marks and apostrophes are now preserved as entered instead of being converted into HTML entities.
  • Other potentially unsafe special characters continue to be escaped, maintaining safe content handling.
  • Plain-text article content is now handled consistently across ticket and article creation workflows.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5a9a3c1d-123f-4b45-9f48-8211e352a8f8

📥 Commits

Reviewing files that changed from the base of the PR and between 8873b2e and 57d014f.

📒 Files selected for processing (3)

• mcp_zammad/models.py
• tests/test_models.py
• tests/test_server.py

---

Walkthrough

Updated ticket and article creation sanitization to preserve quotes and apostrophes while escaping HTML-sensitive characters. Model and server tests now assert the revised plain-text behavior.

Changes

Plain-text sanitization

Layer / File(s)	Summary
Sanitization behavior and regression coverage mcp_zammad/models.py, tests/test_models.py, tests/test_server.py	TicketCreate and plain-text ArticleCreate sanitization now uses html.escape(..., quote=False). Tests verify literal quotes and apostrophes alongside escaped angle brackets.

Estimated code review effort: 2 (Simple) | ~10 minutes

Suggested reviewers: erudition

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is descriptive, follows conventional commit style, and matches the main change to preserve quotes in plain-text content.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Not up to standards ⛔

🔴 Issues 1 minor

Alerts:
⚠ 1 issue (≤ 0 issues of at least minor severity)

Results:
1 new issue

Category	Results
Documentation	1 minor

View in Codacy

🟢 Metrics 0 complexity

Metric	Results
Complexity	0

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}