SEC-004: Sanitize body content in update_handler_factory before GitHub API writes by Copilot · Pull Request #19538 · github/gh-aw

Copilot · 2026-03-04T07:57:37Z

update_handler_factory.cjs was forwarding _rawBody directly to executeUpdate without sanitization, violating the Safe Outputs conformance requirement that any handler accepting free-form body/content fields MUST sanitize before writing to GitHub.

Changes

update_handler_factory.cjs: Import sanitizeContent from sanitize_content.cjs and apply it to updateData._rawBody before executeUpdate is called — covers both live and staged-mode paths since sanitization happens prior to the staged check.

// Sanitize body content before forwarding to the GitHub API (safe outputs conformance)
if (hasRawBody) {
  updateData._rawBody = sanitizeContent(updateData._rawBody);
}

update_handler_factory.test.cjs: Add test asserting that @ mentions in body content are neutralized (e.g. @bot-trigger → `@bot-trigger`) before being passed to executeUpdate.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

https://api.github.com/graphql
- Triggering command: /usr/bin/gh /usr/bin/gh api graphql -f query=query($owner: String!, $name: String!) { repository(owner: $owner, name: $name) { hasDiscussionsEnabled } } -f owner=github -f name=gh-aw GO111MODULE 64/pkg/tool/linux_amd64/link git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/link /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git (http block)
https://api.github.com/repos/actions/ai-inference/git/ref/tags/v1
- Triggering command: /usr/bin/gh gh api /repos/actions/ai-inference/git/ref/tags/v1 --jq .object.sha --get remote.origin.url /usr/bin/git /tmp/go-build210git -trimpath 64/bin/go git conf�� user.email test@example.com /usr/bin/git -json GO111MODULE x_amd64/vet git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v3
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v3 --jq .object.sha -bool -buildtags 414348/b397/vet.cfg -errorsas -ifaceassert -nilfunc /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linu^remote\..*\.gh-resolved$ -ato�� -bool l /usr/bin/gh -errorsas -ifaceassert -nilfunc gh (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v5
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha _.a GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env xYUo5Pmbz cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE x_amd64/vet git rev-�� --show-toplevel x_amd64/vet /usr/bin/git -json GO111MODULE x_amd64/vet git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v5 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git -json cfg 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git 143/001/stabilitgit cfg ache/go/1.25.0/x--show-toplevel git (http block)
https://api.github.com/repos/actions/checkout/git/ref/tags/v6
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --get remote.origin.url cfg k/gh-aw/gh-aw/scgit GOPROXY 64/bin/go git conf�� user.email test@example.com /usr/bin/git /tmp/go-build210git -trimpath 64/bin/go git (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha /tmp/gh-aw-test-runs/20260304-080555-34019/test-1728343999 rev-parse cfg pkg/mod/github.cgit GOPROXY 64/bin/go git conf�� --get remote.origin.url ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet /tmp/go-build210git -trimpath At,event,headBra--show-toplevel ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/checkout/git/ref/tags/v6 --jq .object.sha --show-toplevel 64/pkg/tool/linux_amd64/vet /usr/bin/git -json GO111MODULE 64/pkg/tool/linu--show-toplevel git rev-�� --show-toplevel 64/pkg/tool/linu--json /usr/bin/git -json cfg 64/pkg/tool/linu--show-toplevel git (http block)
https://api.github.com/repos/actions/download-artifact/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq .object.sha 143/001/stability-test.md GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq .object.sha 0555-34019/test-1927054383 GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet rtcf�� -json tmain.go ache/go/1.25.0/x64/pkg/tool/linux_amd64/link GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/link (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/download-artifact/git/ref/tags/v8 --jq .object.sha -json GO111MODULE (http block)
https://api.github.com/repos/actions/github-script/git/ref/tags/v8
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha 43Mi/COIMEuM4xQIGOSUMDB GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 386035/b404/impo-buildtags -c k/gh-aw/gh-aw/pk-errorsas k/gh-aw/gh-aw/pk-ifaceassert 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolc-buildtags (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha prettier --check 64/bin/go **/*.ts **/*.json --ignore-path go env -json GOMOD 64/bin/go tierignore grep 64/bin/go go (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/github-script/git/ref/tags/v8 --jq .object.sha "prettier" --check '**/*.cjs' '*GOINSECURE GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go git cat-�� blob 711f56918db45f6657bdf424e5eda89fGOMOD 64/bin/go -d grep 64/bin/go go (http block)
https://api.github.com/repos/actions/setup-go/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-go/git/ref/tags/v4 --jq .object.sha --show-toplevel 386035/b357/impo-buildtags ache/node/24.13.1/x64/bin/node k/gh-aw/gh-aw/ingit GOPROXY 64/bin/go git t-78�� k/gh-aw/gh-aw/.github/workflows/bot-detection.md /opt/hostedtoolc/tmp/go-build387414348/b263/vet.cfg /usr/bin/git erignore node 64/bin/go git (http block)
https://api.github.com/repos/actions/setup-node/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/setup-node/git/ref/tags/v4 --jq .object.sha /tmp/gh-aw-test-runs/20260304-080555-34019/test-3574285426 config /usr/bin/git remote.origin.urgit GOPROXY 64/bin/go git rev-�� --show-toplevel /opt/hostedtoolc-buildtags e/git /tmp/go-build210git -trimpath 64/bin/go e/git (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v4
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v4 --jq .object.sha --porcelain GOPROXY /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet GOSUMDB GOWORK 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet -uns�� -unreachable=false /tmp/go-build387414348/b082/vet.cfg 414348/b378/vet.cfg -json GO111MODULE 64/bin/go /opt/hostedtoolcache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/actions/upload-artifact/git/ref/tags/v7
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v7 --jq .object.sha xYUo5Pmbz cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env ternal/tools/generate-action-metadata/main.go GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v7 --jq .object.sha -json cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/actions/upload-artifact/git/ref/tags/v7 --jq .object.sha -json cfg x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json GO111MODULE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE ache/go/1.25.0/x64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/1/artifacts
- Triggering command: /usr/bin/gh gh run download 1 --dir test-logs/run-1 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json cfg x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12345/artifacts
- Triggering command: /usr/bin/gh gh run download 12345 --dir test-logs/run-12345 GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet env -json cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linutest@example.com (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/12346/artifacts
- Triggering command: /usr/bin/gh gh run download 12346 --dir test-logs/run-12346 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/2/artifacts
- Triggering command: /usr/bin/gh gh run download 2 --dir test-logs/run-2 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/3/artifacts
- Triggering command: /usr/bin/gh gh run download 3 --dir test-logs/run-3 GO111MODULE 64/pkg/tool/linu-nolocalimports GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu/tmp/go-build387414348/b419/_testmain.go env -json cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/4/artifacts
- Triggering command: /usr/bin/gh gh run download 4 --dir test-logs/run-4 GO111MODULE x_amd64/compile GOINSECURE GOMOD GOMODCACHE x_amd64/compile env -json cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/runs/5/artifacts
- Triggering command: /usr/bin/gh gh run download 5 --dir test-logs/run-5 GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path data/action_pins.json..." GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 386035/b403/impo-buildtags /hom�� che/go-build/92/-errorsas **/*.cjs 64/bin/go **/*.json --ignore-path ../../../.pretti-bool /opt/hostedtoolc-buildtags (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 100 --ignore-path ../../../.pretti-bool go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
- Triggering command: /usr/bin/gh gh run list --json databaseId,number,url,status,conclusion,workflowName,createdAt,startedAt,updatedAt,event,headBranch,headSha,displayTitle --workflow nonexistent-workflow-12345 --limit 6 GOMOD GOMODCACHE x_amd64/vet env -json GO111MODULE 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.0.0 --jq .object.sha -json GO111MODULE At,event,headBranch,headSha,displayTitle GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v1.2.3
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v1.2.3 --jq .object.sha "prettier" --check 'scripts/**/*GOINSECURE node 64/bin/go tierignore --write 64/bin/go go env -json GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE go (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v2.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha "prettier" --check 'scripts/**/*GOINSECURE node 64/bin/go tierignore --write 64/bin/go go env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v2.0.0 --jq .object.sha --check scripts/**/*.js 64/bin/go .prettierignore grep 64/bin/go go env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
https://api.github.com/repos/github/gh-aw/git/ref/tags/v3.0.0
- Triggering command: /usr/bin/gh gh api /repos/github/gh-aw/git/ref/tags/v3.0.0 --jq .object.sha "prettier" --check 'scripts/**/*GOINSECURE node 64/bin/go tierignore --write 64/bin/go go env -json GO111MODULE x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
https://api.github.com/repos/nonexistent/action/git/ref/tags/v999.999.999
- Triggering command: /usr/bin/gh gh api /repos/nonexistent/action/git/ref/tags/v999.999.999 --jq .object.sha y-test.md GO111MODULE 64/pkg/tool/linu-nolocalimports GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linu/tmp/go-build387414348/b424/_testmain.go env 1258614037/.github/workflows cfg x_amd64/vet GOINSECURE GOMOD GOMODCACHE x_amd64/vet (http block)
https://api.github.com/repos/nonexistent/repo/actions/runs/12345
- Triggering command: /usr/bin/gh gh run view 12345 --repo nonexistent/repo --json status,conclusion GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet env -json cfg 64/pkg/tool/linux_amd64/vet GOINSECURE GOMOD GOMODCACHE 64/pkg/tool/linux_amd64/vet (http block)
https://api.github.com/repos/owner/repo/actions/workflows
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE npx pret�� --check scripts/**/*.js 64/bin/go .prettierignore GOWORK 64/bin/go go (http block)
- Triggering command: /usr/bin/gh gh workflow list --json name,state,path --repo owner/repo 64/bin/go GOINSECURE GOMOD GOMODCACHE node /opt�� prettier --check 64/bin/go --ignore-path .prettierignore 64/bin/go go (http block)
https://api.github.com/repos/owner/repo/contents/file.md
- Triggering command: /tmp/go-build387414348/b383/cli.test /tmp/go-build387414348/b383/cli.test -test.testlogfile=/tmp/go-build387414348/b383/testlog.txt -test.paniconexit0 -test.v=true -test.parallel=4 -test.timeout=10m0s -test.run=^Test -test.short=true GOINSECURE GOMOD GOMODCACHE 386035/b355/impo/tmp/go-build387414348/b144/vet.cfg -c k/gh-aw/gh-aw/cmgo1.25.0 GOPROXY 64/bin/go GOSUMDB GOWORK 64/bin/go /opt/hostedtoolc-buildtags (http block)
https://api.github.com/repos/test-owner/test-repo/actions/secrets
- Triggering command: /usr/bin/gh gh api /repos/test-owner/test-repo/actions/secrets --jq .secrets[].name Z2W9/vaMXa9K3kKT-errorsas GO111MODULE 64/bin/go GOINSECURE GOMOD GOMODCACHE 386035/b395/impo-buildtags /hom�� che/go-build/b7/-errorsas **/*.cjs 64/bin/go **/*.json --ignore-path ../../../.pretti-bool /opt/hostedtoolc-buildtags (http block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

This section details on the original issue you should resolve

<issue_title>[Safe Outputs Conformance] SEC-004: update_handler_factory.cjs has body field but no content sanitization</issue_title>
<issue_description>### Conformance Check Failure

Check ID: SEC-004
Severity: MEDIUM
Category: Security

Problem Description

The update_handler_factory.cjs file accepts a body field (stored internally as _rawBody) and passes it to GitHub API update calls, but it does not call any recognized content sanitization function (sanitize, stripHTML, escapeMarkdown, or cleanContent). The Safe Outputs specification requires that any handler accepting free-form body/content fields MUST sanitize the content before writing it to GitHub to prevent injection attacks via issue/PR/comment bodies.

Affected Components

File: actions/setup/js/update_handler_factory.cjs

Current Behavior

The factory creates update handlers that accept a body field. When _rawBody is present it is logged and then forwarded directly to executeUpdate(...) without passing through any sanitization step. The staged-mode preview path also skips sanitization.

Expected Behavior

Before forwarding the body content to the GitHub API, the handler MUST call a sanitization helper (e.g., sanitize(rawBody), escapeMarkdown(rawBody), or an equivalent cleanContent utility) to strip or escape potentially dangerous markup.

Remediation Steps

This task can be assigned to a Copilot coding agent with the following steps:
Identify or create a shared sanitization utility (e.g., sanitize_content.cjs) that implements the escapeMarkdown / cleanContent logic.

Import the sanitization function in actions/setup/js/update_handler_factory.cjs.
Apply the sanitization function to the body value before it is passed to executeUpdate, for example:
const safeBody = sanitize(updateData._rawBody);
Ensure the sanitized value is used consistently in both the live and staged-mode code paths.

Add a brief comment explaining why sanitization is applied (safe outputs conformance).
Verification

After remediation, verify the fix by running:
bash scripts/check-safe-outputs-conformance.sh
Check SEC-004 should pass without errors.

References

Safe Outputs Specification: docs/src/content/docs/reference/safe-outputs-specification.md

Conformance Checker: scripts/check-safe-outputs-conformance.sh

Run ID: §22633945407

Date: 2026-03-03

Generated by Daily Safe Outputs Conformance Checker · ◷

expires on Mar 4, 2026, 5:07 PM UTC

Comments on the Issue (you are @copilot in this section)

Fixes [Safe Outputs Conformance] SEC-004: update_handler_factory.cjs has body field but no content sanitization #19443

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

…date Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot

Pull request overview

Implements SEC-004 safe-outputs conformance by sanitizing free-form body content (_rawBody) inside update_handler_factory before any GitHub API update call.

Changes:

Sanitize updateData._rawBody via sanitizeContent() prior to calling executeUpdate(...).
Add a unit test asserting that _rawBody content is sanitized (specifically, @ mentions are neutralized) before being forwarded to executeUpdate.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

File	Description
actions/setup/js/update_handler_factory.cjs	Imports and applies `sanitizeContent` to `_rawBody` before GitHub API writes.
actions/setup/js/update_handler_factory.test.cjs	Adds a test validating that sanitized `_rawBody` is passed to `executeUpdate`.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

You can also share your feedback on Copilot code review. Take the survey.

actions/setup/js/update_handler_factory.test.cjs

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

Initial plan

711f569

Copilot AI assigned Copilot and pelikhan Mar 4, 2026

Copilot started work on behalf of pelikhan March 4, 2026 07:57 View session

SEC-004: sanitize _rawBody in update_handler_factory before executeUp…

7e93d0c

…date Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix body field sanitization in update_handler_factory~~ SEC-004: Sanitize body content in update_handler_factory before GitHub API writes Mar 4, 2026

Copilot finished work on behalf of pelikhan March 4, 2026 08:10

pelikhan marked this pull request as ready for review March 4, 2026 08:21

Copilot AI review requested due to automatic review settings March 4, 2026 08:21

Merge branch 'main' into copilot/fix-body-field-sanitization

c43c686

Copilot started reviewing on behalf of pelikhan March 4, 2026 08:21 View session

Copilot AI reviewed Mar 4, 2026

View reviewed changes

actions/setup/js/update_handler_factory.test.cjs Outdated Show resolved Hide resolved

Update actions/setup/js/update_handler_factory.test.cjs

b1fac9c

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>

pelikhan merged commit 2979a2e into main Mar 4, 2026
46 checks passed

pelikhan deleted the copilot/fix-body-field-sanitization branch March 4, 2026 08:31

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

SEC-004: Sanitize body content in update_handler_factory before GitHub API writes#19538

SEC-004: Sanitize body content in update_handler_factory before GitHub API writes#19538
pelikhan merged 4 commits intomainfrom
copilot/fix-body-field-sanitization

Copilot AI commented Mar 4, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

Copilot AI commented Mar 4, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

I tried to connect to the following addresses, but was blocked by firewall rules:

Problem Description

Affected Components

Current Behavior

Expected Behavior

Remediation Steps

Verification

References

Comments on the Issue (you are @copilot in this section)

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Mar 4, 2026 •

edited

Loading