test(safe-outputs): verify work item rendering fidelity end to end - #1974

Merged

jamesadevine merged 42 commits into

mainfrom

copilot/update-sanitization-code

Sep 1, 2026

Commits on Aug 16, 2026

Initial plan
Copilot
authored
02c7984
fix: make create-work-item body field configurable

Copilot
and
jamesadevine
authored
023b3f0
fix: validate create-work-item description field

Copilot
and
jamesadevine
authored
70f67e7
fix: harden work item markdown sanitization

Copilot
and
jamesadevine
authored
bbda2cb
fix: broaden active html sanitization

Copilot
and
jamesadevine
authored
bfefbdb
fix: handle quoted dangerous html tags

Copilot
and
jamesadevine
authored
977785a
fix: scan dangerous html tags safely

Copilot
and
jamesadevine
authored
d35cae1
fix: scope html event sanitization to tags

Copilot
and
jamesadevine
authored
41b6067
fix: escape unclosed html tags

Copilot
and
jamesadevine
authored
a9e5b8c
fix: address create work item review findings

Copilot
and
jamesadevine
authored
7ca1523
fix: make custom field validation deterministic

Copilot
and
jamesadevine
authored
2b183f5
fix: validate custom work item fields as field refs

Copilot
and
jamesadevine
authored
ed52772
test: tighten create work item collision assertions

Copilot
and
jamesadevine
authored
270bc6d
refactor: sanitize work item tag config in place

Copilot
and
jamesadevine
authored
65e3b16
fix: clarify default work item body field collisions

Copilot
and
jamesadevine
authored
256d00b
refactor: align work item field validation order

Copilot
and
jamesadevine
authored
786379c
fix: harden markdown html sanitization

Copilot
and
jamesadevine
authored
d32e204
test: clarify sanitizer regression name

Copilot
and
jamesadevine
authored
1b1fa71
fix: preserve fenced markdown code during html sanitization

Copilot
and
jamesadevine
authored
b14f429

Commits on Aug 17, 2026

fix: address final create-work-item review findings

Copilot
and
jamesadevine
authored
48b6a6f
test: relax folded html sanitizer regression assertion

Copilot
and
jamesadevine
authored
7527a96
fix: normalize slash-separated event handler removal

Copilot
and
jamesadevine
authored
f9f0e62
test: use direct folded tag reconstruction case

Copilot
and
jamesadevine
authored
fa22b7e
test: avoid exact whitespace in slash handler regression

Copilot
and
jamesadevine
authored
b4fe773
test: document folded tag regression shape

Copilot
and
jamesadevine
authored
baeb62b
test: fix folded dangerous tag regression shape

Copilot
and
jamesadevine
authored
1bf6274
refactor: make event handler replacement signature explicit

Copilot
and
jamesadevine
authored
62700c3
refactor: simplify event handler separator replacement

Copilot
and
jamesadevine
authored
2d0325a
test: focus slash handler regression on removed payload

Copilot
and
jamesadevine
authored
a287f33

Commits on Aug 20, 2026

refactor(sanitize): allowlist-based Markdown sanitizer

Copilot
and
jamesadevine
authored
eba900a
test(sanitize): cover encoded denied scheme in markdown link

Copilot
and
jamesadevine
authored
bed51f4

Commits on Aug 21, 2026

test(safe-outputs): verify work item rendering fidelity end to end

Copilot
and
jamesadevine
authored
2804cd4
test(safe-outputs): match tilde fences when scoping rendering security checks

Copilot
and
jamesadevine
authored
99099ff
fix(sanitize): anchor destination lookup after the markdown label

Copilot
and
jamesadevine
authored
b8a5087
fix(sanitize): close nested-destination bypass and stop deleting prose that looks like markup

Copilot
and
jamesadevine
authored
94834cf
test(sanitize): spell out what a forged sentinel may not do

Copilot
and
jamesadevine
authored
58cd00a

Commits on Sep 1, 2026

Merge origin/main into copilot/update-sanitization-code
jamesadevine
committed
9560d27
fix(test): account for ADO markdown normalization
jamesadevine
committed
56c29c5
test(executor-e2e): cover markdown storage guards
jamesadevine
committed
a50ddb7
test(executor-e2e): cover missing format metadata
jamesadevine
committed
daba362
fix(sanitize): close markdown validation gaps
jamesadevine
committed
e019016
test(executor-e2e): cover Bug rendering success
jamesadevine
committed
12e478a