Uh oh!
There was an error while loading. Please reload this page.
Sanitize titles for Unicode security and duplicate prefix prevention - #14825
Merged
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
CopilotAI
changed the title
[WIP] Add sanitization for issue and pull request titlesSanitize titles for Unicode security and duplicate prefix preventionFeb 10, 2026
pelikhan
marked this pull request as ready for review
February 10, 2026 19:34
Contributor
There was a problem hiding this comment.
Pull request overview
This PR introduces Unicode security hardening and duplicate prefix prevention for titles in issue, discussion, and pull request handlers. It addresses vulnerabilities to Unicode-based attacks (bidirectional overrides, zero-width characters, fullwidth ASCII) and prevents agents from generating duplicate title prefixes.
Changes:
- New
sanitize_title.cjsmodule withsanitizeTitle()andapplyTitlePrefix()functions - Integration of title sanitization in all create handlers (issues, discussions, PRs)
- Integration of title sanitization in all update handlers (issues, discussions, PRs)
- Comprehensive test suite covering Unicode attacks, prefix deduplication, and edge cases
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated no comments.
Show a summary per file
| File | Description |
|---|---|
| actions/setup/js/sanitize_title.cjs | New module implementing Unicode hardening via hardenUnicodeText() and smart prefix removal with separator handling |
| actions/setup/js/sanitize_title.test.cjs | Comprehensive test suite covering Unicode security, prefix deduplication, and integration scenarios |
| actions/setup/js/create_issue.cjs | Integrates two-step sanitization: sanitizeTitle() to harden and deduplicate, then applyTitlePrefix() to safely apply prefix |
| actions/setup/js/create_discussion.cjs | Same two-step sanitization pattern as create_issue.cjs |
| actions/setup/js/create_pull_request.cjs | Same two-step sanitization pattern as create_issue.cjs |
| actions/setup/js/update_issue.cjs | Applies sanitizeTitle() without prefix parameter (updates don't need prefix handling) |
| actions/setup/js/update_discussion.cjs | Same update-only sanitization pattern as update_issue.cjs |
| actions/setup/js/update_pull_request.cjs | Same update-only sanitization pattern as update_issue.cjs |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Titles in safe output handlers were vulnerable to Unicode-based attacks (bidirectional overrides, zero-width characters, fullwidth ASCII) and agent-generated duplicate prefixes.
Changes
New module
sanitize_title.cjssanitizeTitle(title, titlePrefix)- Applies Unicode hardening viahardenUnicodeText()and strips duplicate prefix occurrences (handles separators::,-,|)applyTitlePrefix(sanitizedTitle, titlePrefix)- Safely applies prefix after sanitizationUnicode security hardening
Integration
create_issue.cjs,create_discussion.cjs,create_pull_request.cjs- Sanitize then apply prefixupdate_issue.cjs,update_discussion.cjs,update_pull_request.cjs- Sanitize only (no prefix handling)Example
Prevents attacks like
"[Agent]\u200B\u202A[Agent]\u202C Fix"→"[Agent] Fix"and ensures consistent, secure title handling across all entity types.✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.