fix: preserve fenced code blocks during URL sanitization to prevent suggestion block corruption#39927
fix: preserve fenced code blocks during URL sanitization to prevent suggestion block corruption#39927Copilot wants to merge 4 commits into
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
…stion block corruption Safe-output URL sanitization (protocol filtering and domain filtering) now uses applyToNonCodeRegions so that content inside fenced code blocks — including GitHub suggestion blocks — is never rewritten. Previously, sanitizeUrlProtocols and sanitizeUrlDomains were applied to the full output string, which could corrupt apply-ready patch payloads inside ```suggestion fences (e.g. custom-protocol docs crosslinks). Fixes #39793 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR fixes safe-output URL sanitization so it does not rewrite content inside fenced code blocks (including GitHub ```suggestion fences), preventing suggestion patch payload corruption while continuing to sanitize URLs in prose.
Changes:
- Apply
sanitizeUrlProtocolsandsanitizeUrlDomainsviaapplyToNonCodeRegionsso fenced/inline code is preserved verbatim. - Add regression tests covering protocol and domain sanitization behavior for generic fenced blocks and
suggestionblocks. - Adjust a header comment in the setup CLI install script.
Show a summary per file
| File | Description |
|---|---|
| actions/setup/js/sanitize_content_core.cjs | Routes URL protocol/domain sanitization through applyToNonCodeRegions to avoid rewriting fenced code content. |
| actions/setup/js/sanitize_content.test.cjs | Adds regression tests ensuring code fences (including suggestion) are preserved while prose is still sanitized. |
| actions/setup-cli/install.sh | Updates a sync note comment (currently becomes self-referential; see review comment). |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 3/3 changed files
- Comments generated: 1
| set +o histexpand | ||
|
|
||
| # Kept in sync with install-gh-aw.sh — edit that file, then copy to this path. | ||
| # Kept in sync with actions/setup-cli/install.sh — edit this file, then copy to that path. |
|
@lpcox review please |
|
@copilot review all comments and address unresolved review feedback.
|
|
Please fix the self-referential sync note in actions/setup-cli/install.sh and push a follow-up commit.
|
|
@copilot review all comments and address unresolved review feedback. Please summarize the remaining blockers and next steps so this branch can move forward.
|
|
@copilot review all comments and address unresolved review feedback.
|
|
\n@copilot review all comments and address unresolved review feedback.\n\npr-sous-chef: fix the self-referential install.sh comment and reply to the unresolved review comment.
|
|
@copilot review all comments and address unresolved review feedback.
|
Safe-output URL sanitization was applied to the full content string, including inside fenced code blocks. This corrupted
suggestionblock payloads — GitHub offers the sanitized text verbatim to commit, so redacted link targets become part of the patch.Changes
sanitize_content_core.cjs: WrapsanitizeUrlProtocolsandsanitizeUrlDomainsinapplyToNonCodeRegions, consistent with all other sanitization transforms (XML comments, link titles, XML tags, template delimiters)sanitize_content.test.cjs: Add four regression tests — protocol-level and domain-level sanitization, for generic fenced blocks andsuggestionblocks specifically — verifying that block content is preserved and prose outside blocks is still sanitized