fix: close XPIA steganographic channel in allowedAliases sanitization path#28055
fix: close XPIA steganographic channel in allowedAliases sanitization path#28055
Conversation
…se XPIA channel The allowedAliases branch in sanitize_content.cjs was missing a call to neutralizeMarkdownLinkTitles, leaving markdown link titles (invisible hover-text) unstripped — an XPIA steganographic injection channel. - Import neutralizeMarkdownLinkTitles from sanitize_content_core.cjs - Call applyToNonCodeRegions(sanitized, neutralizeMarkdownLinkTitles) after removeXmlComments and before neutralizeMentions in the allowedAliases pipeline (matching sanitizeContentCore ordering) - Add three regression tests covering inline titles, reference-style titles, and @mention titles with allowedAliases specified Agent-Logs-Url: https://github.com/github/gh-aw/sessions/583c7f4c-10fe-4aad-ab16-746044faffce Co-authored-by: szabta89 <1330202+szabta89@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Closes a cross-prompt injection channel where Markdown link titles ([text](url "TITLE")) were not being neutralized when allowedAliases is used, allowing hidden payloads to persist in otherwise “safe output” sanitization paths.
Changes:
- Add
neutralizeMarkdownLinkTitlesinto theallowedAliasessanitization pipeline insanitize_content.cjs, matchingsanitizeContentCoreordering. - Add regression tests covering inline link titles, reference-style definitions, and titles containing
@mentionsunder theallowedAliasespath.
Show a summary per file
| File | Description |
|---|---|
| actions/setup/js/sanitize_content.cjs | Adds markdown link-title neutralization to the allowedAliases branch before mention filtering. |
| actions/setup/js/sanitize_content.test.cjs | Adds regression tests ensuring link-title neutralization occurs when allowedAliases is specified. |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/2 changed files
- Comments generated: 1
| // Remove markdown link titles — a steganographic injection channel analogous to HTML comments. | ||
| // Must run before mention neutralization for the same ordering reason as removeXmlComments. |
There was a problem hiding this comment.
The comment says "Remove markdown link titles", but neutralizeMarkdownLinkTitles does not always remove them (inline-link titles are moved into the visible link text, while reference-style titles are stripped). Consider updating the wording to match the function’s behavior (and the more detailed comment in sanitize_content_core.cjs).
| // Remove markdown link titles — a steganographic injection channel analogous to HTML comments. | |
| // Must run before mention neutralization for the same ordering reason as removeXmlComments. | |
| // Neutralize markdown link titles as a hidden/steganographic injection channel analogous to | |
| // HTML comments: inline-link titles are made visible in link text, while reference-style | |
| // titles are stripped. Must run before mention neutralization for the same ordering reason | |
| // as removeXmlComments. |
🧪 Test Quality Sentinel ReportTest Quality Score: 80/100✅ Excellent
Test Classification DetailsView all 3 tests
Flagged Tests — Requires ReviewNo tests flagged. All new tests are behavioral contract tests. Note on test inflation: The test file grew 5× the production file (25 lines vs 5 lines). This is expected and acceptable for security regression tests — they document a vulnerability and require explicit before/after assertions to prevent regressions. The inflation penalty (−10 pts) was applied per rubric, but no manual review is needed. Language SupportTests analyzed:
Verdict
References: §24835090389
|
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
|
@copilot review all comments |
…wedAliases pipeline Agent-Logs-Url: https://github.com/github/gh-aw/sessions/f15821db-6c5f-413b-9d2d-469be2140fd7 Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
|
@copilot merge main and recompile |
…e-markdown-link-titles # Conflicts: # actions/setup/js/sanitize_content.cjs Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Done in d6ff358. Merged main (resolved a comment-only conflict in Warning Firewall rules blocked me from connecting to one or more addresses (expand for details)I tried to connect to the following addresses, but was blocked by firewall rules:
If you need me to access, download, or install something from one of these locations, you can either:
|
Markdown link titles (
[text](url "PAYLOAD")) are invisible in GitHub's rendered UI but delivered verbatim to AI model context, creating a persistent cross-prompt injection channel.neutralizeMarkdownLinkTitleswas present insanitizeContentCorebut absent from the parallelallowedAliasespipeline insanitize_content.cjs— meaning any call withallowedAliases(all safe-output write paths) bypassed this control entirely.Changes
sanitize_content.cjs: ImportneutralizeMarkdownLinkTitlesfrom core and addapplyToNonCodeRegions(sanitized, neutralizeMarkdownLinkTitles)to theallowedAliasespipeline, ordered afterremoveXmlCommentsand beforeneutralizeMentions— matchingsanitizeContentCore.sanitize_content.test.cjs: Three regression tests for theallowedAliasespath covering inline titles, reference-style definitions, and@mention-bearing titles.Before (allowedAliases path):
After:
Warning
Firewall rules blocked me from connecting to one or more addresses (expand for details)
I tried to connect to the following addresses, but was blocked by firewall rules:
invalid.example.invalid/usr/lib/git-core/git-remote-https /usr/lib/git-core/git-remote-https origin https://invalid.example.invalid/nonexistent-repo.git git conf�� user.name lure tions/setup/js/node_modules/.bin/git -M main tnet/tools/git git init�� --bare --initial-branch=main k/gh-aw/gh-aw/actions/setup/js/node_modules/.bin/git user.name Test User ndor/bin/git git(dns block)If you need me to access, download, or install something from one of these locations, you can either: