Fix incomplete multi-character sanitization in source files (pkg/workflow/js)

[Copilot]

The security fix for CodeQL alerts #85, #86, #87 was applied to compiled files in actions/setup/js/ instead of source files in pkg/workflow/js/. This meant the vulnerability would reappear on next compilation.

Changes

• Applied iterative sanitization to source files:

  • pkg/workflow/js/sanitize_content_core.cjs - removeXmlComments()
  • pkg/workflow/js/runtime_import.cjs - removeXMLComments()

• Recompiled all workflow lock files (124 files) to propagate the fix

Implementation

Both functions now use do-while loops to repeatedly apply replacements until no more HTML comment patterns exist:

function removeXMLComments(content) {
  // Remove XML/HTML comments: <!-- ... -->
  // Apply repeatedly to handle nested/overlapping patterns
  let previous;
  do {
    previous = content;
    content = content.replace(/<!--[\s\S]*?-->/g, "");
  } while (content !== previous);
  return content;
}

This prevents bypass via nested patterns like <!--<!--comment-->--> which would leave <!----> after a single pass.

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.