review: absorb HTML entity decoding into the gate's sanitizer tolerance - #375
Merged
Conversation
Run 32758584548 (PR #371) was blocked by rule 7 on a fully conforming review: the staged plan quoted <STOP: ...> entity-escaped in a footer, the ingest sanitizer decoded it and parenthesised the resulting pseudo-tag, and the normalized comparison saw different bodies. Entity decoding was on the documented-not-absorbed residual list; this absorbs it by mirroring sanitize_content_core.cjs's decodeHtmlEntities (v0.85.4) on both sides of the comparison, before the invisible strips, in the sanitizer's order.
🦋 Changeset detectedLatest commit: 3982f10 The changes in this PR will be included in the next version bump. This PR includes changesets to release 1 package
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Contributor
Review live A/BNo reviewable delta: review.md is byte-identical in both arms (baseline |
khan-actions-bot
requested review from
a team,
kevinb-khan and
somewhatabstract
and removed request for
a team
August 24, 2026 18:18
juliahowes124
approved these changes
Aug 24, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The reviewer run on #371 (run 32758584548) died at the dispatch-conformance gate on a fully conforming review: 3 queued comments, 3 planned, verdict staged, and rule 7 still went red. The plan's footer quoted my
<STOP: ...>line entity-escaped (<STOP: ...>, the renderer escapes angle brackets it quotes), gh-aw's ingest sanitizer decoded the entities on the queued side and convertXmlTags parenthesised the resulting pseudo-tag, and the normalized comparison saw two different bodies. The gate failed closed and withheld the whole review, including a blocking finding.HTML entity decoding was already on sanitizer-normalize.ts's documented-not-absorbed residual list ("needs a pathological body"); turns out the pathological body is just a reviewer quoting angle brackets, the same way the
<skill>placeholder shape got absorbed after kore-marketplace run 31609578203. So let's just absorb it:normalizeBodynow mirrors sanitize_content_core.cjs's decodeHtmlEntities (gh-aw v0.85.4: named entities, decimal, hex, one level of&double-encoding), applied to both comparison sides and sequenced before the invisible-character strips exactly as hardenUnicodeText sequences it (an entity-spelled­decodes to U+00AD, which the next fold deletes). An entity-vs-literal splice that changes the text still fails; the incident shape, the decode forms, the ordering, and the out-of-range guard are all pinned in sanitizer-normalize.test.ts.no-jira: reviewer-infra incident fix from run 32758584548; no open lane task covers gate false-blocks.