fix(sanitize): preserve code in sanitized bodies and cover remaining read paths

Full Sanitize runs bluemonday, which escapes entities and silently truncates
a fenced code block at the first '<'. Comment and review bodies are the most
code-dense fields the server returns, so applying it there corrupts content
delivered to the model.

Add sanitize.FilterBody (invisible characters + code fence metadata, no HTML
filtering) and use it for issue comment, PR review, PR review comment and
sub-issue bodies. Titles keep the full Sanitize treatment.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: b8dd0f23-2c6e-47c1-bad5-c1d0c9361f13

Author: IrynaKulakova

pkg/github/issues.go

@@ -951,7 +951,7 @@ func GetSubIssues(ctx context.Context, client *github.Client, deps ToolDependenc
 			subIssue.Title = github.Ptr(sanitize.Sanitize(*subIssue.Title))
 		}
 		if subIssue.Body != nil {
-			subIssue.Body = github.Ptr(sanitize.Sanitize(*subIssue.Body))
+			subIssue.Body = github.Ptr(sanitize.FilterBody(*subIssue.Body))
 		}
 	}
 

pkg/github/issues_test.go

@@ -4738,6 +4738,56 @@ func Test_GetSubIssues(t *testing.T) {
 	}
 }
 
+func Test_GetSubIssues_Sanitization(t *testing.T) {
+	serverTool := IssueRead(translations.NullTranslationHelper)
+
+	hiddenPayload := "Sub-issue\U000E0001\U000E0049\U000E0067\U000E006E\U000E006F\U000E0072\U000E0065"
+	bodyWithCode := "Repro:\n```go\nif a<b { fmt.Println(\"x\") }\n```"
+
+	mockedClient := MockHTTPClientWithHandlers(map[string]http.HandlerFunc{
+		GetReposIssuesSubIssuesByOwnerByRepoByIssueNumber: mockResponse(t, http.StatusOK, []*github.Issue{
+			{
+				Number: github.Ptr(123),
+				Title:  github.Ptr(hiddenPayload),
+				Body:   github.Ptr(hiddenPayload),
+				State:  github.Ptr("open"),
+			},
+			{
+				Number: github.Ptr(124),
+				Title:  github.Ptr("Sub-issue 2"),
+				Body:   github.Ptr(bodyWithCode),
+				State:  github.Ptr("open"),
+			},
+		}),
+	})
+
+	deps := BaseDeps{
+		Client:          mustNewGHClient(t, mockedClient),
+		GQLClient:       githubv4.NewClient(nil),
+		RepoAccessCache: stubRepoAccessCache(nil, 15*time.Minute),
+		Flags:           stubFeatureFlags(map[string]bool{"lockdown-mode": false}),
+	}
+	handler := serverTool.Handler(deps)
+
+	request := createMCPRequest(map[string]any{
+		"method":       "get_sub_issues",
+		"owner":        "owner",
+		"repo":         "repo",
+		"issue_number": float64(42),
+	})
+
+	result, err := handler(ContextWithDeps(context.Background(), deps), &request)
+	require.NoError(t, err)
+
+	var returnedSubIssues []*github.Issue
+	require.NoError(t, json.Unmarshal([]byte(getTextResult(t, result).Text), &returnedSubIssues))
+	require.Len(t, returnedSubIssues, 2)
+
+	assert.Equal(t, "Sub-issue", returnedSubIssues[0].GetTitle(), "hidden characters must be stripped from titles")
+	assert.Equal(t, "Sub-issue", returnedSubIssues[0].GetBody(), "hidden characters must be stripped from bodies")
+	assert.Equal(t, bodyWithCode, returnedSubIssues[1].GetBody(), "code content must survive sanitization")
+}
+
 func TestAddIssueComment(t *testing.T) {
 	t.Parallel()
 

pkg/github/minimal_types.go

@@ -645,7 +645,7 @@ func convertToMinimalPullRequestReview(review *github.PullRequestReview) Minimal
 	m := MinimalPullRequestReview{
 		ID:                review.GetID(),
 		State:             review.GetState(),
-		Body:              review.GetBody(),
+		Body:              sanitize.FilterBody(review.GetBody()),
 		HTMLURL:           review.GetHTMLURL(),
 		User:              convertToMinimalUser(review.GetUser()),
 		CommitID:          review.GetCommitID(),
@@ -821,9 +821,9 @@ func convertToMinimalIssuesResponse(fragment IssueQueryFragment) MinimalIssuesRe
 func convertToMinimalIssueComment(comment *github.IssueComment) MinimalIssueComment {
 	m := MinimalIssueComment{
 		ID: comment.GetID(),
-		// Bodies carry the same invisible-glyph / HTML injection surface as
+		// Comment bodies carry the same invisible-glyph injection surface as
 		// issue and PR bodies, which the read paths already sanitize.
-		Body:              sanitize.Sanitize(comment.GetBody()),
+		Body:              sanitize.FilterBody(comment.GetBody()),
 		HTMLURL:           comment.GetHTMLURL(),
 		User:              convertToMinimalUser(comment.GetUser()),
 		AuthorAssociation: comment.GetAuthorAssociation(),
@@ -1911,7 +1911,7 @@ func convertToMinimalReviewThread(thread reviewThreadNode) MinimalReviewThread {
 
 func convertToMinimalReviewComment(c reviewCommentNode) MinimalReviewComment {
 	m := MinimalReviewComment{
-		Body:    string(c.Body),
+		Body:    sanitize.FilterBody(string(c.Body)),
 		Path:    string(c.Path),
 		Author:  string(c.Author.Login),
 		HTMLURL: c.URL.String(),

pkg/github/minimal_types_test.go

@@ -0,0 +1,76 @@
+package github
+
+import (
+	"net/url"
+	"testing"
+
+	"github.com/google/go-github/v89/github"
+	"github.com/shurcooL/githubv4"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// bodyWithHiddenPayload embeds Unicode tag characters, which are invisible to a
+// human reviewer but legible to a model.
+const bodyWithHiddenPayload = "Looks good\U000E0001\U000E0049\U000E0067\U000E006E\U000E006F\U000E0072\U000E0065"
+
+const bodyWithCode = "Compare with:\n```go\nif a<b { fmt.Println(\"x\") }\n```\nand <Foo/> in JSX."
+
+func TestConvertToMinimalIssueCommentSanitizesBody(t *testing.T) {
+	t.Run("strips hidden characters", func(t *testing.T) {
+		m := convertToMinimalIssueComment(&github.IssueComment{
+			ID:   github.Ptr(int64(1)),
+			Body: github.Ptr(bodyWithHiddenPayload),
+		})
+		assert.Equal(t, "Looks good", m.Body)
+	})
+
+	t.Run("preserves code content", func(t *testing.T) {
+		m := convertToMinimalIssueComment(&github.IssueComment{
+			ID:   github.Ptr(int64(1)),
+			Body: github.Ptr(bodyWithCode),
+		})
+		assert.Equal(t, bodyWithCode, m.Body)
+	})
+}
+
+func TestConvertToMinimalPullRequestReviewSanitizesBody(t *testing.T) {
+	t.Run("strips hidden characters", func(t *testing.T) {
+		m := convertToMinimalPullRequestReview(&github.PullRequestReview{
+			ID:   github.Ptr(int64(1)),
+			Body: github.Ptr(bodyWithHiddenPayload),
+		})
+		assert.Equal(t, "Looks good", m.Body)
+	})
+
+	t.Run("preserves code content", func(t *testing.T) {
+		m := convertToMinimalPullRequestReview(&github.PullRequestReview{
+			ID:   github.Ptr(int64(1)),
+			Body: github.Ptr(bodyWithCode),
+		})
+		assert.Equal(t, bodyWithCode, m.Body)
+	})
+}
+
+func TestConvertToMinimalReviewCommentSanitizesBody(t *testing.T) {
+	commentURL, err := url.Parse("https://github.com/owner/repo/pull/1#discussion_r1")
+	require.NoError(t, err)
+
+	t.Run("strips hidden characters", func(t *testing.T) {
+		m := convertToMinimalReviewComment(reviewCommentNode{
+			Body: githubv4.String(bodyWithHiddenPayload),
+			Path: githubv4.String("main.go"),
+			URL:  githubv4.URI{URL: commentURL},
+		})
+		assert.Equal(t, "Looks good", m.Body)
+	})
+
+	t.Run("preserves code content", func(t *testing.T) {
+		m := convertToMinimalReviewComment(reviewCommentNode{
+			Body: githubv4.String(bodyWithCode),
+			Path: githubv4.String("main.go"),
+			URL:  githubv4.URI{URL: commentURL},
+		})
+		assert.Equal(t, bodyWithCode, m.Body)
+	})
+}

pkg/sanitize/sanitize.go

@@ -15,6 +15,15 @@ func Sanitize(input string) string {
 	return FilterHTMLTags(FilterCodeFenceMetadata(FilterInvisibleCharacters(input)))
 }
 
+// FilterBody strips the injection surface that matters for markdown bodies —
+// invisible glyphs and hidden code-fence info strings — without running the
+// HTML filter. Bodies routinely contain code (generics, JSX, shell redirects),
+// and HTML filtering silently truncates a fenced block at the first '<', which
+// would corrupt the content delivered to the model.
+func FilterBody(input string) string {
+	return FilterCodeFenceMetadata(FilterInvisibleCharacters(input))
+}
+
 // FilterInvisibleCharacters removes invisible or control characters that should not appear
 // in user-facing titles or bodies. This includes:
 // - Unicode tag characters: U+E0001, U+E0020–U+E007F

pkg/sanitize/sanitize_test.go

@@ -300,3 +300,53 @@ func TestSanitizeRemovesInvisibleCodeFenceMetadata(t *testing.T) {
 	result := Sanitize(input)
 	assert.Equal(t, expected, result)
 }
+
+func TestFilterBody(t *testing.T) {
+	tests := []struct {
+		name     string
+		input    string
+		expected string
+	}{
+		{
+			name:     "removes unicode tag characters",
+			input:    "hello\U000E0001\U000E0068\U000E0069world",
+			expected: "helloworld",
+		},
+		{
+			name:     "removes bidi overrides",
+			input:    "safe\u202Ereversed\u202C",
+			expected: "safereversed",
+		},
+		{
+			name:     "strips hidden code fence metadata",
+			input:    "```steal secrets\nfmt.Println(42)\n```",
+			expected: "```\nfmt.Println(42)\n```",
+		},
+		{
+			name:     "preserves angle brackets in prose",
+			input:    "a < b && c > d",
+			expected: "a < b && c > d",
+		},
+		{
+			name:     "preserves code fences containing angle brackets",
+			input:    "```go\nif a<b { fmt.Println(\"x\") }\n```",
+			expected: "```go\nif a<b { fmt.Println(\"x\") }\n```",
+		},
+		{
+			name:     "preserves html-like markup",
+			input:    "use <Foo/> component",
+			expected: "use <Foo/> component",
+		},
+		{
+			name:     "empty string",
+			input:    "",
+			expected: "",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			assert.Equal(t, tt.expected, FilterBody(tt.input))
+		})
+	}
+}