Function sanitizeContentCore

actions/setup/js/sanitize_content_core.cjs:1250–1319

* Core sanitization function without mention filtering * @param {string} content - The content to sanitize * @param {number} [maxLength] - Maximum length of content (default: 524288) * @param {number} [maxBotMentions] - Max bot trigger references before filtering (default: MAX_BOT_TRIGGER_REFEREN

(content, maxLength, maxBotMentions)

 * @returns {string} The sanitized content
 */
function sanitizeContentCore(content, maxLength, maxBotMentions) {
  if (!content || typeof content !== "string") {
    return "";
  }

  // Build list of allowed domains from environment and GitHub context
  const allowedDomains = buildAllowedDomains();

  // Build list of allowed GitHub references from environment
  const allowedGitHubRefs = buildAllowedGitHubReferences();

  let sanitized = content;

  // Apply Unicode hardening first to normalize text representation
  // This prevents Unicode-based attacks and ensures consistent processing
  sanitized = hardenUnicodeText(sanitized);

  // Remove ANSI escape sequences and control characters early
  // This must happen before mention neutralization to avoid creating bare mentions
  // when control characters are removed between @ and username
  sanitized = sanitized.replace(/\x1b\[[0-9;]*[mGKH]/g, "");
  // Remove control characters except newlines (\n), tabs (\t), and carriage returns (\r)
  sanitized = sanitized.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, "");

  // Neutralize commands at the start of text (e.g., /bot-name)
  sanitized = neutralizeCommands(sanitized);

  // Remove XML comments before mention neutralization to prevent bypass: if removeXmlComments
  // ran after neutralizeAllMentions, a comment like <!-- @user payload --> would first become
  // <!-- `@user` payload --> and applyFnOutsideInlineCode would split at the backtick boundary,
  // preventing the full <!--...--> pattern from being matched.
  sanitized = applyToNonCodeRegions(sanitized, removeXmlComments);

  // Remove markdown link titles — a steganographic injection channel analogous to HTML comments.
  // Quoted title text ([text](url "TITLE") and [ref]: url "TITLE") is invisible in GitHub's
  // rendered markdown (shown only as hover-tooltips) but reaches the AI model verbatim.
  // Must run before mention neutralization for the same ordering reason as removeXmlComments.
  sanitized = applyToNonCodeRegions(sanitized, neutralizeMarkdownLinkTitles);

  // Neutralize ALL @mentions (no filtering in core version)
  sanitized = neutralizeAllMentions(sanitized);

  // Convert XML tags to parentheses format – skip code blocks and inline code so that
  // type parameters (e.g. VBuffer<float32>) and code containing angle brackets are preserved
  sanitized = applyToNonCodeRegions(sanitized, convertXmlTags);

  // URI filtering - replace non-https protocols with "(redacted)"
  sanitized = applyURLSanitizationPolicy(sanitized, allowedDomains);

  // Apply truncation limits
  sanitized = applyTruncation(sanitized, maxLength);

  // Neutralize GitHub references if restrictions are configured
  sanitized = neutralizeGitHubReferences(sanitized, allowedGitHubRefs);

  // Neutralize common bot trigger phrases
  sanitized = neutralizeBotTriggers(sanitized, maxBotMentions);