Skip to content

fix(sanitize): preserve angle brackets inside code blocks and inline code #2408

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
blackwell-systems wants to merge 3 commits into
base: main
Choose a base branch
from
Open

fix(sanitize): preserve angle brackets inside code blocks and inline code #2408

Show file tree
Hide file tree
Changes from 2 commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
ac2718a
fix(sanitize): preserve angle brackets inside code blocks and inline …
blackwell-systems Apr 30, 2026
3c28543
fix: prevent sentinel collision XSS and document closing-fence deviation
blackwell-systems May 17, 2026
64e6ffb
refactor: use goldmark CommonMark parser for code block detection
blackwell-systems Jun 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
168 changes: 166 additions & 2 deletions pkg/sanitize/sanitize.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,7 +12,14 @@ var policy *bluemonday.Policy
var policyOnce sync.Once

func Sanitize(input string) string {
return FilterHTMLTags(FilterCodeFenceMetadata(FilterInvisibleCharacters(input)))
cleaned := FilterCodeFenceMetadata(FilterInvisibleCharacters(input))
// Protect angle brackets inside code blocks and inline code spans
// from being stripped by the HTML sanitizer. bluemonday treats <int>,
// <T>, etc. as unknown HTML tags and removes them.
// See https://github.com/github/github-mcp-server/issues/2202
protected := protectCodeAngleBrackets(cleaned)
sanitized := FilterHTMLTags(protected)
return restoreCodeAngleBrackets(sanitized)
Comment on lines 36 to +44

@SamMorrowDrums SamMorrowDrums May 31, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Optional: pull out the ordering as a named invariant so future readers don't accidentally reorder these calls. The security argument relies on FilterInvisibleCharacters running first (so NUL is stripped before sentinels are introduced) and on restoreCodeAngleBrackets running last (after FilterHTMLTags).

Suggested change
func Sanitize(input string) string {
return FilterHTMLTags(FilterCodeFenceMetadata(FilterInvisibleCharacters(input)))
cleaned := FilterCodeFenceMetadata(FilterInvisibleCharacters(input))
// Protect angle brackets inside code blocks and inline code spans
// from being stripped by the HTML sanitizer. bluemonday treats <int>,
// <T>, etc. as unknown HTML tags and removes them.
// See https://github.com/github/github-mcp-server/issues/2202
protected := protectCodeAngleBrackets(cleaned)
sanitized := FilterHTMLTags(protected)
return restoreCodeAngleBrackets(sanitized)
func Sanitize(input string) string {
// Ordering is security-load-bearing:
// 1. FilterInvisibleCharacters strips NUL bytes BEFORE sentinels are
// introduced, preventing an attacker from forging \x00LT\x00 in input.
// 2. protectCodeAngleBrackets replaces < and > inside code with sentinels
// so bluemonday does not strip them as HTML.
// 3. FilterHTMLTags (bluemonday) sanitizes prose; sentinels pass through.
// 4. restoreCodeAngleBrackets converts sentinels back to < and >.
// See https://github.com/github/github-mcp-server/issues/2202
cleaned := FilterCodeFenceMetadata(FilterInvisibleCharacters(input))
protected := protectCodeAngleBrackets(cleaned)
sanitized := FilterHTMLTags(protected)
return restoreCodeAngleBrackets(sanitized)
}

}

// FilterInvisibleCharacters removes invisible or control characters that should not appear
Expand Down Expand Up @@ -145,6 +152,162 @@ func isSafeCodeFenceToken(token string) bool {
return true
}

// Sentinels used to protect angle brackets inside code from HTML sanitization.
// These are chosen to be unlikely to appear in real content.
const (
ltSentinel = "\x00LT\x00"
gtSentinel = "\x00GT\x00"
)
Comment on lines +178 to +185

@SamMorrowDrums SamMorrowDrums May 31, 2026

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Worth noting in the doc comment that the NUL-stripping in FilterInvisibleCharacters is what makes these sentinels collision-free — it's a non-obvious dependency.

Suggested change
// Sentinels used to protect angle brackets inside code from HTML sanitization.
// These are chosen to be unlikely to appear in real content.
const (
ltSentinel = "\x00LT\x00"
gtSentinel = "\x00GT\x00"
)
// Sentinels used to protect angle brackets inside code from HTML sanitization.
// They embed NUL bytes, which are stripped from all input by
// FilterInvisibleCharacters before this function runs — that strip is what
// makes the sentinels collision-free against attacker-controlled input.
const (
ltSentinel = "\x00LT\x00"
gtSentinel = "\x00GT\x00"
)


// protectCodeAngleBrackets replaces < and > inside fenced code blocks and
// inline code spans with sentinels so bluemonday does not strip them as HTML.
func protectCodeAngleBrackets(input string) string {
var b strings.Builder
b.Grow(len(input))

runes := []rune(input)
i := 0
n := len(runes)

for i < n {
// Fenced code block: ``` ... ```
if i+2 < n && runes[i] == '`' && runes[i+1] == '`' && runes[i+2] == '`' {
// Find the fence length
fenceStart := i
fenceLen := 0
for i < n && runes[i] == '`' {
fenceLen++
i++
}
// Write opening fence + rest of line (info string)
for range fenceLen {
b.WriteRune('`')
}
for i < n && runes[i] != '\n' {
b.WriteRune(runes[i])
i++
}
if i < n {
b.WriteRune(runes[i]) // newline
i++
}
// Inside fence: protect angle brackets until closing fence.
// NOTE: CommonMark requires the closing fence to be on its own line
// with no info string. This implementation is more permissive: any
// run of >= fenceLen backticks ends the block, even mid-line. This
// is a soft-fail (some angle brackets may be unprotected) rather
// than a security issue.
for i < n {
// Check for closing fence
if runes[i] == '`' {
closeLen := 0
j := i
for j < n && runes[j] == '`' {
closeLen++
j++
}
if closeLen >= fenceLen {
for range closeLen {
b.WriteRune('`')
}
i = j
break
}
}
switch runes[i] {
case '<':
b.WriteString(ltSentinel)
case '>':
b.WriteString(gtSentinel)
default:
b.WriteRune(runes[i])
}
i++
}
_ = fenceStart
continue
}

// Inline code: `...`
if runes[i] == '`' {
// Count opening backticks
openLen := 0
j := i
for j < n && runes[j] == '`' {
openLen++
j++
}
// Don't treat ``` as inline code (handled above for fenced blocks)
if openLen >= 3 {
for range openLen {
b.WriteRune('`')
}
i = j
continue
}
// Find matching closing backticks
closeStart := -1
for k := j; k <= n-openLen; k++ {
match := true
for m := range openLen {
if runes[k+m] != '`' {
match = false
break
}
}
if match {
// Verify it's exactly openLen backticks (not more)
if k+openLen < n && runes[k+openLen] == '`' {
continue
}
closeStart = k
break
}
}
if closeStart == -1 {
// No closing backticks found; treat as literal
for range openLen {
b.WriteRune('`')
}
i = j
continue
}
// Write opening backticks
for range openLen {
b.WriteRune('`')
}
// Protect content
for i = j; i < closeStart; i++ {
switch runes[i] {
case '<':
b.WriteString(ltSentinel)
case '>':
b.WriteString(gtSentinel)
default:
b.WriteRune(runes[i])
}
}
// Write closing backticks
for range openLen {
b.WriteRune('`')
}
i = closeStart + openLen
continue
}

b.WriteRune(runes[i])
i++
}

return b.String()
}

// restoreCodeAngleBrackets converts sentinels back to angle brackets.
func restoreCodeAngleBrackets(input string) string {
s := strings.ReplaceAll(input, ltSentinel, "<")
return strings.ReplaceAll(s, gtSentinel, ">")
}

func getPolicy() *bluemonday.Policy {
policyOnce.Do(func() {
p := bluemonday.StrictPolicy()
Expand Down Expand Up @@ -175,7 +338,8 @@ func getPolicy() *bluemonday.Policy {

func shouldRemoveRune(r rune) bool {
switch r {
case 0x200B, // ZERO WIDTH SPACE
case 0x0000, // NUL — stripped to prevent sentinel collision in protectCodeAngleBrackets
0x200B, // ZERO WIDTH SPACE
0x200C, // ZERO WIDTH NON-JOINER
0x200E, // LEFT-TO-RIGHT MARK
0x200F, // RIGHT-TO-LEFT MARK
Expand Down
57 changes: 57 additions & 0 deletions pkg/sanitize/sanitize_test.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -129,6 +129,7 @@ func TestShouldRemoveRune(t *testing.T) {
expected bool
}{
// Individual characters that should be removed
{name: "NUL byte", rune: 0x0000, expected: true},
{name: "zero width space", rune: 0x200B, expected: true},
{name: "zero width non-joiner", rune: 0x200C, expected: true},
{name: "left-to-right mark", rune: 0x200E, expected: true},
Expand Down Expand Up @@ -300,3 +301,59 @@ func TestSanitizeRemovesInvisibleCodeFenceMetadata(t *testing.T) {
result := Sanitize(input)
assert.Equal(t, expected, result)
}

func TestSanitizePreservesAngleBracketsInCodeBlocks(t *testing.T) {
tests := []struct {
name string
input string
expected string
}{
{
name: "fenced code block with angle brackets",
input: "```\nlet ptr: mut_raw_ptr<int> = raw_new int;\n```",
expected: "```\nlet ptr: mut_raw_ptr<int> = raw_new int;\n```",
},
{
name: "inline code with angle brackets",
input: "Use `Vec<String>` for collections.",
expected: "Use `Vec<String>` for collections.",
},
{
name: "angle brackets outside code are sanitized",
input: "This has <script>alert('xss')</script> in it.",
expected: "This has in it.",
},
{
name: "fenced code block with generic types",
input: "Example:\n```go\nfunc Foo[T comparable](x T) {}\n```\nDone.",
expected: "Example:\n```go\nfunc Foo[T comparable](x T) {}\n```\nDone.",
},
{
name: "multiple inline code spans with angle brackets",
input: "Compare `Map<K, V>` and `Set<T>`.",
expected: "Compare `Map<K, V>` and `Set<T>`.",
},
{
name: "no code blocks passes through",
input: "No code here, just text.",
expected: "No code here, just text.",
},
{
name: "sentinel collision does not bypass sanitizer",
input: "\x00LT\x00script\x00GT\x00alert(1)\x00LT\x00/script\x00GT\x00",
expected: "LTscriptGTalert(1)LT/scriptGT", // NUL bytes stripped; sentinels don't match; no <script> injected
},
{
name: "NUL bytes stripped from input with code blocks",
input: "```\nfunc Foo\x00[T any]()\n```",
expected: "```\nfunc Foo[T any]()\n```",
},
}

for _, tt := range tests {
t.Run(tt.name, func(t *testing.T) {
result := Sanitize(tt.input)
assert.Equal(t, tt.expected, result)
})
}
}