[Safe Outputs Conformance] SEC-004: Multiple handlers have body fields without content sanitization

[github-actions]

Conformance Check Failure

Check ID: SEC-004
Severity: MEDIUM
Category: Security

Problem Description

Four handler files include "body" or body: fields in their output payloads but do not call any recognized sanitization function (sanitize, stripHTML, escapeMarkdown, cleanContent). The Safe Outputs specification requires that content destined for GitHub API bodies be sanitized to prevent injection of malicious Markdown or HTML.

Affected Components

• actions/setup/js/close_agentic_workflows_issues.cjs
• actions/setup/js/mcp_cli_bridge.cjs
• actions/setup/js/mount_mcp_as_cli.cjs
• actions/setup/js/start_mcp_gateway.cjs

🔍 Current vs Expected Behavior

Current Behavior

Each of the four files constructs or passes through a body value without sanitizing it before use. For example, close_agentic_workflows_issues.cjs uses body: NO_REPRO_MESSAGE directly; mcp_cli_bridge.cjs and the other files expose an httpPostJSON helper whose body parameter is serialized without sanitization.

Expected Behavior

Any string value placed into a body field that may reach a GitHub API call (issue body, PR comment, etc.) should be passed through a sanitization step — e.g. sanitize(content), escapeMarkdown(content), or stripHTML(content) — before serialization. If the body is fully internal/constant and never derived from untrusted input, an exemption annotation should be added with justification.

Remediation Steps

This task can be assigned to a Copilot coding agent with the following steps:

1. For each file in the checklist above:
   a. Identify every code path where a body value is produced and may reach a GitHub API call.
   b. If the body can contain caller-supplied or untrusted content, wrap it with a shared sanitize() / escapeMarkdown() utility before use.
   c. If the body is a hardcoded constant (e.g. NO_REPRO_MESSAGE) and never interpolates untrusted input, add a comment explaining why sanitization is not required — the conformance check will still flag it, so consider adding a @safe-outputs-exempt SEC-004 annotation with justification.
2. Add or update unit tests covering the sanitization path.
3. Ensure the sanitization utility is consistent across all four files (prefer a shared helper in a common module).

Verification

After remediation, verify the fix by running:

bash scripts/check-safe-outputs-conformance.sh

Check SEC-004 should pass without errors.

References

• Safe Outputs Specification: docs/src/content/docs/reference/safe-outputs-specification.md
• Conformance Checker: scripts/check-safe-outputs-conformance.sh
• Run ID: §24640126160
• Date: 2026-04-19

Generated by Daily Safe Outputs Conformance Checker · ● 97K · ◷

• expires on Apr 20, 2026, 10:02 PM UTC