fix: strip `title=` and `data-*` attributes in `stripDangerousAttributes` to close hidden injection channel by Copilot · Pull Request #31707 · github/gh-aw

Copilot · 2026-05-12T14:40:12Z

Bug Fix

What was the bug?

stripDangerousAttributes classified title as safe and preserved it verbatim. Because title= values are invisible in GitHub's rendered markdown (hover-tooltip only) but present in the raw text delivered to the agent, this is a steganographic injection channel — structurally identical to the one already closed for markdown link titles by neutralizeMarkdownLinkTitles. The same gap exists for data-* attributes, which GitHub's GFM sanitizer strips from rendered HTML but passes through in raw text.

A payload like see here reached the agent unchanged (Changed: false).

How did you fix it?

Extended the stripDangerousAttributes regex in convertXmlTags to cover both hidden channels:

// Before
/[\s/]+(?:on\w+|style)(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>"'`]*))?/gi

// After — also strips title= and data-*
/[\s/]+(?:on\w+|style|title|data-[\w-]+)(?:\s*=\s*(?:"[^"]*"|'[^']*'|[^\s>"'`]*))?/gi

With this change, see here is sanitized to see here. The JSDoc comment is updated to document the rationale and remove title from the "safe" list.

Testing

Updated 4 existing tests that expected title= to be preserved.
Added 7 new tests covering title= stripping (double-quoted, single-quoted, unquoted values; multiple tags) and data-* stripping (simple, hyphenated, and case-insensitive attribute names).

Co-authored-by: szabta89 <1330202+szabta89@users.noreply.github.com>

Closes the steganographic injection channel where title= attribute values on allowed GFM tags passed through sanitization unchanged. These values are invisible in GitHub rendered markdown (hover-tooltip only) but arrive at the agent verbatim — identical in nature to the markdown link title channel already neutralized by neutralizeMarkdownLinkTitles. Also strips data-* attributes since GitHub's GFM sanitizer removes them from rendered HTML output, making them another invisible raw-text channel. - Extend the stripDangerousAttributes regex with `title` and `data-[\w-]+` - Update JSDoc comment to document the new stripped attributes and rationale - Update 4 existing tests that expected title= to be preserved - Add 7 new tests covering both channels Co-authored-by: szabta89 <1330202+szabta89@users.noreply.github.com>

Copilot

Pull request overview

This PR closes a hidden prompt-injection/steganographic channel by stripping title= and data-* attributes from allowlisted HTML tags during sanitization, ensuring these invisible-to-rendered-GFM values don’t reach the agent verbatim.

Changes:

Extend stripDangerousAttributes in convertXmlTags() to remove title and data-* attributes (in addition to on* and style).
Update/expand sanitization tests to assert title=/data-* stripping across quoting forms and cases.
Update Dependabot workflow Docker socket handling to respect DOCKER_HOST when determining the socket path to mount.

Show a summary per file

File	Description
actions/setup/js/sanitize_content_core.cjs	Expands dangerous-attribute stripping to include `title` and `data-*`, with updated rationale in JSDoc.
actions/setup/js/sanitize_content.test.cjs	Updates existing expectations and adds regression tests for `title=`/`data-*` stripping.
.github/workflows/dependabot-worker.lock.yml	Adjusts Docker socket path selection/mounting logic based on `DOCKER_HOST`.
.github/workflows/dependabot-campaign.lock.yml	Same Docker socket path selection/mounting adjustment as above.

Copilot's findings

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 4/4 changed files
Comments generated: 3

+    // Match: one-or-more whitespace-or-slash + (on* | style | title | data-*) + optional =value
    // Value forms: "...", '...', or unquoted (no whitespace / > / quote chars), or bare (no =)
    // The unquoted form excludes >, whitespace, and all quote characters (', ", `) so it
    // cannot consume the closing > of the tag or straddle other attribute values.
    // Using [\s/]+ (instead of \s+) also strips dangerous attributes that are immediately


+          case "${DOCKER_HOST:-}" in
+            unix://* ) DOCKER_SOCK_PATH="${DOCKER_HOST#unix://}" ;;
+            /* ) DOCKER_SOCK_PATH="$DOCKER_HOST" ;;
+            * ) DOCKER_SOCK_PATH=/var/run/docker.sock ;;
+          esac
+          DOCKER_SOCK_GID=$(stat -c '%g' "$DOCKER_SOCK_PATH" 2>/dev/null || echo '0')
+          export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host --add-host host.docker.internal:127.0.0.1 --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v '"${DOCKER_SOCK_PATH}"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -e GITHUB_AW_OTEL_TRACE_ID -e GITHUB_AW_OTEL_PARENT_SPAN_ID -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.3.6'


+          case "${DOCKER_HOST:-}" in
+            unix://* ) DOCKER_SOCK_PATH="${DOCKER_HOST#unix://}" ;;
+            /* ) DOCKER_SOCK_PATH="$DOCKER_HOST" ;;
+            * ) DOCKER_SOCK_PATH=/var/run/docker.sock ;;
+          esac
+          DOCKER_SOCK_GID=$(stat -c '%g' "$DOCKER_SOCK_PATH" 2>/dev/null || echo '0')
+          export MCP_GATEWAY_DOCKER_COMMAND='docker run -i --rm --network host --add-host host.docker.internal:127.0.0.1 --user '"${MCP_GATEWAY_UID}"':'"${MCP_GATEWAY_GID}"' --group-add '"${DOCKER_SOCK_GID}"' -v '"${DOCKER_SOCK_PATH}"':/var/run/docker.sock -e MCP_GATEWAY_PORT -e MCP_GATEWAY_DOMAIN -e MCP_GATEWAY_API_KEY -e MCP_GATEWAY_PAYLOAD_DIR -e MCP_GATEWAY_PAYLOAD_SIZE_THRESHOLD -e DOCKER_HOST=unix:///var/run/docker.sock -e DEBUG -e MCP_GATEWAY_LOG_DIR -e GH_AW_MCP_LOG_DIR -e GH_AW_SAFE_OUTPUTS -e GH_AW_SAFE_OUTPUTS_CONFIG_PATH -e GH_AW_SAFE_OUTPUTS_TOOLS_PATH -e GH_AW_ASSETS_BRANCH -e GH_AW_ASSETS_MAX_SIZE_KB -e GH_AW_ASSETS_ALLOWED_EXTS -e DEFAULT_BRANCH -e GITHUB_MCP_SERVER_TOKEN -e GITHUB_MCP_GUARD_MIN_INTEGRITY -e GITHUB_MCP_GUARD_REPOS -e GITHUB_REPOSITORY -e GITHUB_SERVER_URL -e GITHUB_SHA -e GITHUB_WORKSPACE -e GITHUB_TOKEN -e GITHUB_RUN_ID -e GITHUB_RUN_NUMBER -e GITHUB_RUN_ATTEMPT -e GITHUB_JOB -e GITHUB_ACTION -e GITHUB_EVENT_NAME -e GITHUB_EVENT_PATH -e GITHUB_ACTOR -e GITHUB_ACTOR_ID -e GITHUB_TRIGGERING_ACTOR -e GITHUB_WORKFLOW -e GITHUB_WORKFLOW_REF -e GITHUB_WORKFLOW_SHA -e GITHUB_REF -e GITHUB_REF_NAME -e GITHUB_REF_TYPE -e GITHUB_HEAD_REF -e GITHUB_BASE_REF -e GH_AW_SAFE_OUTPUTS_PORT -e GH_AW_SAFE_OUTPUTS_API_KEY -e GITHUB_AW_OTEL_TRACE_ID -e GITHUB_AW_OTEL_PARENT_SPAN_ID -v /tmp/gh-aw/mcp-payloads:/tmp/gh-aw/mcp-payloads:rw -v /opt:/opt:ro -v /tmp:/tmp:rw -v '"${GITHUB_WORKSPACE}"':'"${GITHUB_WORKSPACE}"':rw ghcr.io/github/gh-aw-mcpg:v0.3.6'


pelikhan · 2026-05-12T15:48:55Z

@copilot merge main, recompile, review all comments

…gerous-attributes Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

…ripping Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot · 2026-05-12T15:57:31Z

@copilot merge main, recompile, review all comments

Done — merged main, rebuilt the binary, and recompiled all 221 workflow lock files (no diff; lock files were already current after the merge). Also addressed the reviewer feedback: updated the inline comment at line 716 from "Strip dangerous attributes (on* event handlers and style)" to "Strip dangerous attributes (on* event handlers, style, title, data-*)" so it matches the actual regex behavior.

Initial plan

36d67dc

Copilot AI assigned Copilot and szabta89 May 12, 2026

Copilot started work on behalf of szabta89 May 12, 2026 14:40 View session

Copilot AI linked an issue May 12, 2026 that may be closed by this pull request

stripDangerousAttributes preserves title= attribute verbatim — steganographic injection channel in allowed GFM tags #31705

Closed

Copilot AI and others added 2 commits May 12, 2026 14:47

chore: initial plan for title/data-* attribute stripping

97d45a5

Co-authored-by: szabta89 <1330202+szabta89@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix stripDangerousAttributes to handle title attribute~~ fix: strip title= and data-* attributes in stripDangerousAttributes to close hidden injection channel May 12, 2026

Copilot AI requested a review from szabta89 May 12, 2026 15:01

Copilot finished work on behalf of szabta89 May 12, 2026 15:01

pelikhan marked this pull request as ready for review May 12, 2026 15:41

Copilot AI review requested due to automatic review settings May 12, 2026 15:41

Copilot AI reviewed May 12, 2026

View reviewed changes

Copilot started work on behalf of pelikhan May 12, 2026 15:49 View session

Copilot AI and others added 2 commits May 12, 2026 15:54

Merge remote-tracking branch 'origin/main' into copilot/fix-strip-dan…

8f63676

…gerous-attributes Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

fix: update inline comment to reflect expanded dangerous attribute st…

1b3d211

…ripping Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>

Copilot AI requested a review from pelikhan May 12, 2026 15:59

Copilot finished work on behalf of pelikhan May 12, 2026 15:59

pelikhan merged commit c609547 into main May 12, 2026

pelikhan deleted the copilot/fix-strip-dangerous-attributes branch May 12, 2026 16:20

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

fix: strip `title=` and `data-*` attributes in `stripDangerousAttributes` to close hidden injection channel#31707

fix: strip `title=` and `data-*` attributes in `stripDangerousAttributes` to close hidden injection channel#31707
pelikhan merged 5 commits into
mainfrom
copilot/fix-strip-dangerous-attributes

Copilot AI commented May 12, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

pelikhan commented May 12, 2026

Uh oh!

Copilot AI commented May 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

Copilot AI commented May 12, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bug Fix

What was the bug?

How did you fix it?

Testing

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Copilot's findings

Uh oh!

pelikhan commented May 12, 2026

Uh oh!

Copilot AI commented May 12, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Copilot AI commented May 12, 2026 •

edited

Loading