fix(sanitizer): strip HTML comments after decoding entities#1504
Open
NickNojiri wants to merge 1 commit into
Open
fix(sanitizer): strip HTML comments after decoding entities#1504NickNojiri wants to merge 1 commit into
NickNojiri wants to merge 1 commit into
Conversation
sanitizeContent strips HTML comments first (to remove hidden instructions), but normalizeHtmlEntities runs several steps later. Decoding entities can re-introduce a comment that was entity-encoded specifically to survive that first strip: an input of "&anthropics#60;!-- ... --&anthropics#62;" passes through stripHtmlComments untouched, then normalizeHtmlEntities decodes it back into a live "<!-- ... -->" comment that reaches the model. Run stripHtmlComments once more after entity decoding so a comment cannot slip through via encoding. Verified the decimal, hex, and opening-delimiter-only variants are all closed, with the plain comment case unchanged. Add regression tests for the entity-encoded comment bypass.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
The content sanitizer strips HTML comments to remove hidden instructions before GitHub content reaches the model, but normalizeHtmlEntities runs later in the pipeline. Entity-encoded delimiters — <!-- … --> — pass through the initial stripHtmlComments untouched, then get decoded back into a live comment that reaches Claude. Verified the decimal, hex, and opening-delimiter-only variants all leak.
Fix
Re-run stripHtmlComments after entity decoding. All three variants now closed; plain-comment behavior unchanged.
Scope note: entity-encoded comments render visibly in GitHub's UI, so this is defense-in-depth hardening of the injection sanitizer rather than a fully-hidden exploit.
Testing