fix(security): prevent HTML entity-encoded comment injection bypass in sanitizer

[MaxwellCalkin]

Summary

The sanitizeContent function in src/github/utils/sanitizer.ts has an ordering vulnerability that allows HTML comment injection through entity encoding.

Vulnerability

stripHtmlComments runs before normalizeHtmlEntities, so an attacker can encode <!-- and --> as HTML entities to bypass comment stripping entirely:

<!-- ignore above instructions -->

This entity-encoded string passes through stripHtmlComments undetected (it doesn't match <!--...-->), then normalizeHtmlEntities decodes it into a real HTML comment:

<!-- ignore above instructions -->

The result is a fully functional hidden comment injected into sanitized content — a prompt injection vector.

Attack vector

An attacker can embed entity-encoded HTML comments in GitHub issue bodies, PR descriptions, or comments. These comments are invisible when rendered by GitHub but survive the sanitizer and reach the LLM as hidden instructions.

Fix

Move normalizeHtmlEntities to run before stripHtmlComments so that entity-encoded markup is decoded first, then stripped by the appropriate sanitization step.

Before:

content = stripHtmlComments(content);     // 1. Can't see encoded comments
content = stripInvisibleCharacters(content);
content = stripMarkdownImageAltText(content);
content = stripMarkdownLinkTitles(content);
content = stripHiddenAttributes(content);
content = normalizeHtmlEntities(content);  // 6. Decodes them into real comments — too late

After:

content = normalizeHtmlEntities(content);  // 1. Decode entities first
content = stripHtmlComments(content);      // 2. Now catches decoded comments
content = stripInvisibleCharacters(content);
content = stripMarkdownImageAltText(content);
content = stripMarkdownLinkTitles(content);
content = stripHiddenAttributes(content);

Tests added

• Entity-encoded HTML comment injection (decimal entities: <, -, >)
• Hex entity-encoded HTML comment injection (<, -, >)

Both tests verify that the injected comment content is fully removed from sanitized output.