Skip to content

Apply consistent sanitization to untrusted GitHub response fields #3106

Description

@SamMorrowDrums

Describe the bug

Sanitization is applied by individual response converters, which leaves inconsistent coverage across issue comments, pull request bodies, reviews, review comments, releases, commit messages, and similar user-authored fields. Centralize or systematically audit response sanitization while preserving source-code and file-content fidelity.

Affected version

Current main as of 2026-08-19.

Steps to reproduce the behavior

  1. Return user-authored text through different GitHub tools.
  2. Compare fields processed by sanitize.Sanitize with fields returned directly.
  3. Observe inconsistent filtering across equivalent untrusted-text surfaces.

Expected vs actual behavior

Expected: equivalent user-authored text is sanitized consistently, with a content-safe strategy for source code and file contents.

Actual: filtering depends on the converter used by each tool.

Logs

N/A

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions