You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
Apply consistent sanitization to untrusted GitHub response fields #3106
Sanitization is applied by individual response converters, which leaves inconsistent coverage across issue comments, pull request bodies, reviews, review comments, releases, commit messages, and similar user-authored fields. Centralize or systematically audit response sanitization while preserving source-code and file-content fidelity.
Affected version
Current main as of 2026-08-19.
Steps to reproduce the behavior
Return user-authored text through different GitHub tools.
Compare fields processed by sanitize.Sanitize with fields returned directly.
Observe inconsistent filtering across equivalent untrusted-text surfaces.
Expected vs actual behavior
Expected: equivalent user-authored text is sanitized consistently, with a content-safe strategy for source code and file contents.
Actual: filtering depends on the converter used by each tool.
Activity
Centralize sanitization of untrusted GitHub response fields
Centralize sanitization of untrusted GitHub response fields