Sanitize remaining issue-ref and blame headline response paths

Route every MinimalIssueRef/MinimalPullRequestRef construction through shared
constructors that sanitize the user-authored title, so issue_dependency_read,
issue_dependency_write and find_duplicate no longer forward raw issue titles.

Also sanitize the get_file_blame commit message headline, after truncation so
the headline is still cut at the author's real first line break.

Extends the sanitization regression suite with the project status update body,
both ref constructors and the dependency ref, and adds tool-level regression
tests for find_duplicate and get_file_blame.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: SamMorrowDrums

pkg/github/find_duplicate.go

@@ -152,12 +152,15 @@ func FindDuplicate(t translations.TranslationHelperFunc) inventory.ServerTool {
 					return utils.NewToolResultError("ranked duplicate detection is unavailable: the semantic-similarity endpoint returned issues without ranking metadata (the server-side duplicate-ranking feature is not enabled for this caller or repository)"), nil, nil
 				}
 				candidates = append(candidates, duplicateCandidate{
-					Issue: MinimalIssueRef{
-						Number: res.Issue.Number,
-						Title:  res.Issue.Title,
-						State:  res.Issue.State,
-						URL:    res.Issue.HTMLURL,
-					},
+					// Candidates are always scoped to the requested repository, so the
+					// ref's repository field is left empty as it was before.
+					Issue: newMinimalIssueRef(
+						res.Issue.Number,
+						res.Issue.Title,
+						res.Issue.State,
+						res.Issue.HTMLURL,
+						"",
+					),
 					Score:           res.Score,
 					Confidence:      res.Confidence,
 					LikelyDuplicate: res.LikelyDuplicate,

pkg/github/find_duplicate_test.go

@@ -120,6 +120,52 @@ func Test_FindDuplicate_RankedResults(t *testing.T) {
 	assert.False(t, candidates[1].LikelyDuplicate)
 }
 
+// Test_FindDuplicate_SanitizesIssueTitle asserts that candidate issue titles, which are
+// user-authored content from an arbitrary repository, are sanitized before being returned.
+// Without this the tool would forward hidden-instruction payloads straight to the model.
+func Test_FindDuplicate_SanitizesIssueTitle(t *testing.T) {
+	serverTool := FindDuplicate(translations.NullTranslationHelper)
+
+	rankedResults := []map[string]any{
+		{
+			"issue": map[string]any{
+				"number":   456,
+				"title":    maliciousText,
+				"state":    "open",
+				"html_url": "https://github.com/owner/repo/issues/456",
+			},
+			"score":            0.95,
+			"confidence":       "high",
+			"likely_duplicate": true,
+		},
+	}
+
+	handler := func(w http.ResponseWriter, _ *http.Request) {
+		w.WriteHeader(http.StatusOK)
+		_, _ = w.Write(MustMarshal(rankedResults))
+	}
+
+	client := mustNewGHClient(t, NewMockedHTTPClient(WithRequestMatchHandler(endpointSemanticallySimilar, http.HandlerFunc(handler))))
+	deps := BaseDeps{Client: client}
+	toolHandler := serverTool.Handler(deps)
+
+	request := createMCPRequest(map[string]any{
+		"owner":        "owner",
+		"repo":         "repo",
+		"issue_number": float64(123),
+	})
+	result, err := toolHandler(ContextWithDeps(context.Background(), deps), &request)
+	require.NoError(t, err)
+	require.False(t, result.IsError, "expected result to not be an error")
+
+	text := getTextResult(t, result)
+	var candidates []duplicateCandidate
+	require.NoError(t, json.Unmarshal([]byte(text.Text), &candidates))
+	require.Len(t, candidates, 1)
+	assert.Equal(t, sanitizedText, candidates[0].Issue.Title)
+	assert.NotContains(t, text.Text, "<script>")
+}
+
 func Test_FindDuplicate_OmitsUnsetParams(t *testing.T) {
 	serverTool := FindDuplicate(translations.NullTranslationHelper)
 

pkg/github/issue_dependencies.go

@@ -171,16 +171,17 @@ func issueToDependencyRef(issue *github.Issue) MinimalIssueRef {
 	if issue == nil {
 		return MinimalIssueRef{}
 	}
-	ref := MinimalIssueRef{
-		Number: issue.GetNumber(),
-		Title:  issue.GetTitle(),
-		State:  strings.ToUpper(issue.GetState()),
-		URL:    issue.GetHTMLURL(),
-	}
+	var repository string
 	if owner, repo, ok := parseRepositoryURL(issue.GetRepositoryURL()); ok {
-		ref.Repository = owner + "/" + repo
+		repository = owner + "/" + repo
 	}
-	return ref
+	return newMinimalIssueRef(
+		issue.GetNumber(),
+		issue.GetTitle(),
+		strings.ToUpper(issue.GetState()),
+		issue.GetHTMLURL(),
+		repository,
+	)
 }
 
 // IssueDependencyWrite creates a tool to add or remove an issue dependency

pkg/github/issues.go

@@ -2196,27 +2196,27 @@ func fetchIssueReadEnrichment(ctx context.Context, gqlClient *githubv4.Client, n
 
 		if p := n.Issue.Parent; p != nil {
 			enrichment.Parent = &issueReadParent{
-				Ref: MinimalIssueRef{
-					Number:     int(p.Number),
-					Title:      sanitize.Sanitize(string(p.Title)),
-					State:      string(p.State),
-					URL:        string(p.URL),
-					Repository: string(p.Repository.NameWithOwner),
-				},
+				Ref: newMinimalIssueRef(
+					int(p.Number),
+					string(p.Title),
+					string(p.State),
+					string(p.URL),
+					string(p.Repository.NameWithOwner),
+				),
 				AuthorLogin: string(p.Author.Login),
 			}
 		}
 
 		closing := make([]issueReadClosingPullRequest, 0, len(n.Issue.ClosedByPullRequestsReferences.Nodes))
 		for _, pr := range n.Issue.ClosedByPullRequestsReferences.Nodes {
 			closing = append(closing, issueReadClosingPullRequest{
-				Ref: MinimalPullRequestRef{
-					Number:     int(pr.Number),
-					Title:      sanitize.Sanitize(string(pr.Title)),
-					State:      string(pr.State),
-					URL:        string(pr.URL),
-					Repository: string(pr.Repository.NameWithOwner),
-				},
+				Ref: newMinimalPullRequestRef(
+					int(pr.Number),
+					string(pr.Title),
+					string(pr.State),
+					string(pr.URL),
+					string(pr.Repository.NameWithOwner),
+				),
 				AuthorLogin: string(pr.Author.Login),
 			})
 		}

pkg/github/minimal_types.go

@@ -616,6 +616,19 @@ type MinimalPullRequestRef struct {
 	Repository string `json:"repository,omitempty"`
 }
 
+// newMinimalPullRequestRef builds a MinimalPullRequestRef, sanitizing the user-authored
+// title. Callers should use it rather than the struct literal so every tool surfacing a
+// pull request reference strips untrusted content identically.
+func newMinimalPullRequestRef(number int, title, state, url, repository string) MinimalPullRequestRef {
+	return MinimalPullRequestRef{
+		Number:     number,
+		Title:      sanitize.Sanitize(title),
+		State:      state,
+		URL:        url,
+		Repository: repository,
+	}
+}
+
 // MinimalIssueRef is a compact reference to a related issue (e.g. a parent issue).
 // Its keys mirror the get_parent (GetIssueParent) response shape.
 type MinimalIssueRef struct {
@@ -626,6 +639,20 @@ type MinimalIssueRef struct {
 	Repository string `json:"repository,omitempty"`
 }
 
+// newMinimalIssueRef builds a MinimalIssueRef, sanitizing the user-authored title. Callers
+// should use it rather than the struct literal so every tool surfacing an issue reference
+// (issue_read's parent, issue_dependency_read/write, find_duplicate) strips untrusted
+// content identically.
+func newMinimalIssueRef(number int, title, state, url, repository string) MinimalIssueRef {
+	return MinimalIssueRef{
+		Number:     number,
+		Title:      sanitize.Sanitize(title),
+		State:      state,
+		URL:        url,
+		Repository: repository,
+	}
+}
+
 // MinimalSubIssuesSummary holds the native GraphQL subIssuesSummary counts for an issue.
 type MinimalSubIssuesSummary struct {
 	Total            int `json:"total"`

pkg/github/repositories.go

@@ -16,6 +16,7 @@ import (
 	"github.com/github/github-mcp-server/pkg/ifc"
 	"github.com/github/github-mcp-server/pkg/inventory"
 	"github.com/github/github-mcp-server/pkg/octicons"
+	"github.com/github/github-mcp-server/pkg/sanitize"
 	"github.com/github/github-mcp-server/pkg/scopes"
 	"github.com/github/github-mcp-server/pkg/translations"
 	"github.com/github/github-mcp-server/pkg/utils"
@@ -2950,8 +2951,10 @@ func GetFileBlame(t translations.TranslationHelperFunc) inventory.ServerTool {
 				}
 				headline = strings.TrimRight(headline, " \t\r")
 				bc := BlameCommit{
-					SHA:             sha,
-					MessageHeadline: headline,
+					SHA: sha,
+					// Sanitized after truncation so the headline is cut at the author's real
+					// first line break rather than one introduced by sanitization.
+					MessageHeadline: sanitize.Sanitize(headline),
 					CommittedDate:   r.Commit.CommittedDate.Format("2006-01-02T15:04:05Z"),
 					Author: BlameAuthor{
 						Name:  string(r.Commit.Author.Name),

pkg/github/repositories_test.go

@@ -6075,6 +6075,54 @@ func Test_GetFileBlame(t *testing.T) {
 				assert.Nil(t, br.Commits["xyz789abc123"].Author.Login, "anonymous author has no login")
 			},
 		},
+		{
+			// Commit messages are user-authored and untrusted: the headline must be
+			// truncated at the author's real first line break and then sanitized.
+			name: "blame commit message headline is sanitized",
+			mockedClient: githubv4mock.NewMockedHTTPClient(
+				githubv4mock.NewQueryMatcher(
+					blameQueryShape{},
+					makeBlameVars("testowner", "testrepo", "HEAD", "README.md"),
+					githubv4mock.DataResponse(map[string]any{
+						"repository": map[string]any{
+							"defaultBranchRef": map[string]any{"name": "main"},
+							"object": map[string]any{
+								"__typename": "Commit",
+								"blame": map[string]any{
+									"ranges": []map[string]any{
+										{
+											"startingLine": 1, "endingLine": 3, "age": 1,
+											"commit": map[string]any{
+												"oid":           "badc0ffee0000",
+												"message":       maliciousText + "\n\nLong body that should not appear.",
+												"committedDate": "2024-01-03T10:00:00Z",
+												"author": map[string]any{
+													"name": "Bob Developer", "email": "bob@example.com",
+													"user": nil,
+												},
+											},
+										},
+									},
+								},
+							},
+						},
+					}),
+				),
+			),
+			requestArgs: map[string]any{
+				"owner": "testowner",
+				"repo":  "testrepo",
+				"path":  "README.md",
+			},
+			validateResponse: func(t *testing.T, result string) {
+				var br BlameResult
+				require.NoError(t, json.Unmarshal([]byte(result), &br))
+				require.Contains(t, br.Commits, "badc0ffee0000")
+				assert.Equal(t, sanitizedText, br.Commits["badc0ffee0000"].MessageHeadline)
+				assert.NotContains(t, result, "<script>")
+				assert.NotContains(t, result, "Long body that should not appear")
+			},
+		},
 		{
 			name: "successful blame with annotated tag ref",
 			mockedClient: githubv4mock.NewMockedHTTPClient(

pkg/github/sanitize_coverage_test.go

@@ -4,6 +4,7 @@ import (
 	"encoding/json"
 	"net/url"
 	"testing"
+	"time"
 
 	"github.com/google/go-github/v89/github"
 	"github.com/shurcooL/githubv4"
@@ -194,6 +195,35 @@ func Test_MinimalConverters_SanitizeUserAuthoredText(t *testing.T) {
 				}).Title
 			},
 		},
+		{
+			name: "project status update body (projects_get / projects_list)",
+			got: func() string {
+				return convertToMinimalStatusUpdate(statusUpdateNode{
+					Body:      githubv4.NewString(githubv4.String(maliciousText)),
+					CreatedAt: githubv4.DateTime{Time: time.Unix(0, 0).UTC()},
+				}).Body
+			},
+		},
+		{
+			name: "issue ref title (shared constructor)",
+			got: func() string {
+				return newMinimalIssueRef(1, maliciousText, "OPEN", "https://github.com/o/r/issues/1", "o/r").Title
+			},
+		},
+		{
+			name: "pull request ref title (shared constructor)",
+			got: func() string {
+				return newMinimalPullRequestRef(1, maliciousText, "OPEN", "https://github.com/o/r/pull/1", "o/r").Title
+			},
+		},
+		{
+			name: "issue dependency ref title (issue_dependency_read / issue_dependency_write)",
+			got: func() string {
+				return issueToDependencyRef(&github.Issue{
+					Title: github.Ptr(maliciousText),
+				}).Title
+			},
+		},
 	}
 
 	for _, tt := range tests {