Decode HTML entities before @mention detection to prevent bypass

[Copilot]

HTML-encoded @ symbols (@, @, @) were not decoded before @mention regex matching, allowing potential bypass if GitHub's renderer decodes entities post-sanitization.

Changes

• Added decodeHtmlEntities() function to handle named, decimal, hex, and double-encoded entities with Unicode validation (0-0x10FFFF)
• Positioned entity decoding as step 2 in hardenUnicodeText() pipeline, after NFC normalization and before full-width ASCII conversion
• Exported function for testing and potential reuse

Implementation

function decodeHtmlEntities(text) {
  let result = text;
  
  // Named entities: @, @ → @
  result = result.replace(/&(?:amp;)?commat;/gi, "@");
  
  // Decimal entities: @, @ → @
  result = result.replace(/&(?:amp;)?#(\d+);/g, (match, code) => {
    const codePoint = parseInt(code, 10);
    return (codePoint >= 0 && codePoint <= 0x10ffff) 
      ? String.fromCodePoint(codePoint) 
      : match;
  });
  
  // Hex entities: &#x40;, &amp;#x40; → @
  result = result.replace(/&(?:amp;)?#[xX]([0-9a-fA-F]+);/g, (match, code) => {
    const codePoint = parseInt(code, 16);
    return (codePoint >= 0 && codePoint <= 0x10ffff)
      ? String.fromCodePoint(codePoint)
      : match;
  });
  
  return result;
}

Entity decoding now occurs before @mention regex evaluation, ensuring encoded @ symbols are properly neutralized:

// Before: @user → "@user" (bypass)
// After:  @user → "`@user`" (neutralized)

Files modified:

• actions/setup/js/sanitize_content_core.cjs: Added decoding function and integrated into Unicode hardening
• actions/setup/js/sanitize_content.test.cjs: Added 27 test cases covering entity formats and edge cases

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

[Copilot]

Pull request overview

This PR strengthens the JavaScript sanitization pipeline to prevent bypassing @mention neutralization via HTML entity-encoded @ characters by decoding relevant HTML entities early in hardenUnicodeText().

Changes:

• Added decodeHtmlEntities() and integrated it into hardenUnicodeText() before mention detection runs.
• Implemented decoding for @ and numeric entities (decimal + hex), including & double-encoded variants.
• Added comprehensive tests covering encoded-mention scenarios and general numeric entity decoding.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 3 comments.

File	Description
actions/setup/js/sanitize_content_core.cjs	Adds HTML entity decoding helper and runs it early in Unicode hardening to prevent mention-bypass via encoded @.
actions/setup/js/sanitize_content.test.cjs	Adds tests validating that entity-encoded mentions are decoded and then neutralized, plus numeric-entity decoding cases.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.