Decode HTML entities before @mention detection to prevent bypass

actions/setup/js/sanitize_content.test.cjs

@@ -1318,4 +1318,132 @@ describe("sanitize_content.cjs", () => {
  });
  });
  });
+
+ describe("HTML entity decoding for @mention bypass prevention", () => {
+ it("should decode @ and neutralize resulting @mention", () => {
+ const result = sanitizeContent("Please review @pelikhan");
+ expect(result).toBe("Please review `@pelikhan`");
+ });
+
+ it("should decode double-encoded @ and neutralize resulting @mention", () => {
+ const result = sanitizeContent("Please review @pelikhan");
+ expect(result).toBe("Please review `@pelikhan`");
+ });
+
+ it("should decode @ (decimal) and neutralize resulting @mention", () => {
+ const result = sanitizeContent("Please review @pelikhan");
+ expect(result).toBe("Please review `@pelikhan`");
+ });
+
+ it("should decode double-encoded @ and neutralize resulting @mention", () => {
+ const result = sanitizeContent("Please review @pelikhan");
+ expect(result).toBe("Please review `@pelikhan`");
+ });
+
+ it("should decode @ (hex lowercase) and neutralize resulting @mention", () => {
+ const result = sanitizeContent("Please review @pelikhan");
+ expect(result).toBe("Please review `@pelikhan`");
+ });
+
+ it("should decode @ (hex uppercase) and neutralize resulting @mention", () => {
+ const result = sanitizeContent("Please review @pelikhan");
+ expect(result).toBe("Please review `@pelikhan`");
+ });
+
+ it("should decode double-encoded @ and neutralize resulting @mention", () => {
+ const result = sanitizeContent("Please review @pelikhan");
+ expect(result).toBe("Please review `@pelikhan`");
+ });
+
+ it("should decode double-encoded @ and neutralize resulting @mention", () => {
+ const result = sanitizeContent("Please review @pelikhan");
+ expect(result).toBe("Please review `@pelikhan`");
+ });
+
+ it("should decode multiple HTML-encoded @mentions", () => {
+ const result = sanitizeContent("@user1 and @user2 and @user3");
+ expect(result).toBe("`@user1` and `@user2` and `@user3`");
+ });
+
+ it("should decode mixed HTML entities and normal @mentions", () => {
+ const result = sanitizeContent("@user1 and @user2");
+ expect(result).toBe("`@user1` and `@user2`");
+ });
+
+ it("should decode HTML entities in org/team mentions", () => {
+ const result = sanitizeContent("@myorg/myteam should review");
+ expect(result).toBe("`@myorg/myteam` should review");
+ });
+
+ it("should decode general decimal entities correctly", () => {
+ const result = sanitizeContent("Hello"); // "Hello"
+ expect(result).toBe("Hello");
+ });
+
+ it("should decode general hex entities correctly", () => {
+ const result = sanitizeContent("Hello"); // "Hello"
+ expect(result).toBe("Hello");
+ });
+
+ it("should decode double-encoded general entities correctly", () => {
+ const result = sanitizeContent("Hello"); // "&Hello"
+ expect(result).toBe("Hello");
+ });
+
+ it("should handle invalid code points gracefully", () => {
+ const result = sanitizeContent("Invalid � entity");
+ expect(result).toBe("Invalid � entity"); // Keep original if invalid
+ });
+
+ it("should handle malformed HTML entities without crashing", () => {
+ const result = sanitizeContent("Malformed &# or &#x entity");
+ expect(result).toBe("Malformed &# or &#x entity");
+ });
+
+ it("should decode entities before Unicode hardening", () => {
+ // Ensure entity decoding happens as part of hardenUnicodeText
+ const result = sanitizeContent("！"); // Full-width exclamation (U+FF01)
+ expect(result).toBe("!"); // Should become ASCII !
+ });
+
+ it("should decode entities in combination with other sanitization", () => {
+ const result = sanitizeContent("&commat;user <!-- comment --> text");
+ expect(result).toBe("`@user` text");
+ });
+
+ it("should decode entities even in backticks (security-first approach)", () => {
+ // Entities are decoded during Unicode hardening, which happens before
+ // mention neutralization. This is intentional - we decode entities early
+ // to prevent bypasses, then the @mention gets neutralized properly.
+ const result = sanitizeContent("`&commat;user`");
+ expect(result).toBe("`@user`");
+ });
+
+ it("should preserve legitimate URLs after entity decoding", () => {
+ const result = sanitizeContent("Visit https://github.com/user");
+ expect(result).toBe("Visit https://github.com/user");
+ });
+
+ it("should decode case-insensitive named entities", () => {
+ const result = sanitizeContent("&COMMAT;user and &CoMmAt;user2");
+ expect(result).toBe("`@user` and `@user2`");
+ });
+
+ it("should decode entities with mixed case hex digits", () => {
+ const result = sanitizeContent("&#x4O; is invalid but &#x4A; is valid"); // Note: using letter 'O' not digit '0'
+ expect(result).toContain("&#x4O;"); // Invalid should remain
+ expect(result).toContain("J"); // Valid 0x4A = J
+ });
+
+ it("should handle zero code point", () => {
+ const result = sanitizeContent("&#0;text");
+ // Code point 0 is valid but typically removed as control character
+ expect(result).toContain("text");
+ });
+
+ it("should respect allowed aliases even with HTML-encoded mentions", () => {
+ const result = sanitizeContent("&commat;author is allowed", { allowedAliases: ["author"] });
+ expect(result).toBe("@author is allowed");
+ });
+ });
 });

actions/setup/js/sanitize_content_core.cjs

@@ -485,6 +485,54 @@ function applyTruncation(content, maxLength) {
  return content;
 }
 
+/**
+ * Decodes HTML entities to prevent bypass of @mention detection.
+ * Handles named entities (e.g., @), decimal entities (e.g., @),
+ * and hex entities (e.g., @), including double-encoded variants (e.g., @).
+ *
+ * @param {string} text - Input text that may contain HTML entities
+ * @returns {string} Text with HTML entities decoded
+ */
+function decodeHtmlEntities(text) {
+ if (!text || typeof text !== "string") {
+ return "";
+ }
+
+ let result = text;
+
+ // Decode named entity for @ symbol (including double-encoded variants)
+ // @ and @ → @
+ result = result.replace(/&(?:amp;)?commat;/gi, "@");
+
+ // Decode decimal entities (including double-encoded variants)
+ // @ and @ → @
+ // &#NNN; and &#NNN; → corresponding character
+ result = result.replace(/&(?:amp;)?#(\d+);/g, (match, code) => {
+ const codePoint = parseInt(code, 10);
+ // Validate code point is in valid Unicode range
+ if (codePoint >= 0 && codePoint <= 0x10ffff) {
+ return String.fromCodePoint(codePoint);
+ }
+ // Return original match if invalid
+ return match;
+ });
+
+ // Decode hex entities (including double-encoded variants)
+ // &#x40;, &#X40;, &amp;#x40;, &amp;#X40; → @
+ // &#xHHH;, &#XHHH;, &amp;#xHHH;, &amp;#XHHH; → corresponding character
+ result = result.replace(/&(?:amp;)?#[xX]([0-9a-fA-F]+);/g, (match, code) => {
+ const codePoint = parseInt(code, 16);
+ // Validate code point is in valid Unicode range
+ if (codePoint >= 0 && codePoint <= 0x10ffff) {
+ return String.fromCodePoint(codePoint);
+ }
+ // Return original match if invalid
+ return match;
+ });
+
+ return result;
+}
+
 /**
  * Performs text hardening to protect against Unicode-based attacks.
  * This applies multiple layers of character normalization and filtering
@@ -504,16 +552,21 @@ function hardenUnicodeText(text) {
  // This ensures consistent character representation across different encodings
  result = result.normalize("NFC");
 
- // Step 2: Strip invisible zero-width characters that can hide content
+ // Step 2: Decode HTML entities to prevent @mention bypass
+ // This MUST happen early, before any other processing, to ensure entities
+ // are converted to their actual characters for proper sanitization
+ result = decodeHtmlEntities(result);
+
+ // Step 3: Strip invisible zero-width characters that can hide content
  // These include: zero-width space, zero-width non-joiner, zero-width joiner,
  // word joiner, and byte order mark
  result = result.replace(/[\u200B\u200C\u200D\u2060\uFEFF]/g, "");
 
- // Step 3: Remove bidirectional text override controls
+ // Step 4: Remove bidirectional text override controls
  // These can be used to reverse text direction and create visual spoofs
  result = result.replace(/[\u202A\u202B\u202C\u202D\u202E\u2066\u2067\u2068\u2069]/g, "");
 
- // Step 4: Convert full-width ASCII characters to standard ASCII
+ // Step 5: Convert full-width ASCII characters to standard ASCII
  // Full-width characters (U+FF01-FF5E) can be used to bypass filters
  result = result.replace(/[\uFF01-\uFF5E]/g, char => {
  const code = char.charCodeAt(0);
@@ -611,4 +664,5 @@ module.exports = {
  neutralizeBotTriggers,
  applyTruncation,
  hardenUnicodeText,
+ decodeHtmlEntities,
 };