fix: fixed copilot comments - #603
Merged
Merged
Conversation
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request hardens the GitHub Actions email-notification workflow by HTML-escaping dynamic, workflow-sourced values before embedding them into HTML email templates, reducing the risk of HTML/attribute injection.
Changes:
- Added an
html_escapeshell helper in notification steps and used it to sanitize actor/branch/resource-group values. - Updated email templates to reference the sanitized variables (
${ACTOR},${BRANCH},${RESOURCE_GROUP}) instead of raw workflow/context values. - Applied the escaped variables consistently across failure/success notification variants.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Prajwal-Microsoft
approved these changes
May 25, 2026
|
🎉 This PR is included in version 2.1.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
pull Bot
pushed a commit
to ScorpiusDraconis83/content-processing-solution-accelerator
that referenced
this pull request
Aug 10, 2026
NPM (ContentProcessorWeb pnpm overrides): - websocket-driver -> ^0.7.5 (CRITICAL, microsoft#541) - axios 1.16.0 -> 1.18.0 (microsoft#558) - brace-expansion ^2.0.3 -> ^2.1.2 (microsoft#587) - fast-uri 3.1.2 -> 3.1.4 (microsoft#602/microsoft#604) - immutable ^5.1.5 -> ^5.1.8 (microsoft#600/microsoft#601) - js-yaml ^4.2.0 -> ^4.3.0 (microsoft#588) - shell-quote ^1.8.4 -> ^1.9.0 (microsoft#589) - svgo ^2.8.1 -> ^2.8.3 (microsoft#603) - react-router-dom 7.15.1 -> 7.18.1 (microsoft#611 DoS) Python (uv): - pillow 12.2.0 -> 12.3.0 (ContentProcessor) - pyasn1 0.6.3 -> 0.6.4 (ContentProcessor, Workflow) - mcp 1.25.0 -> 1.28.1 (Workflow); transitive mcp -> 1.29.0 (ContentProcessor) Deferred: react-router microsoft#610 (RSC CSRF, fixed only in v8.3.0 major; RSC mode unused by this CRA SPA). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 22668762-66d8-4311-b4c2-ee147376b71d
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
This pull request enhances the security of the email notification workflow by ensuring that dynamic values embedded in email templates are properly HTML-escaped. This prevents potential HTML or attribute injection vulnerabilities from workflow inputs such as actor names, branch names, and resource group names. Additionally, the workflow now consistently uses these escaped variables throughout the email templates for all notification scenarios.
The most important changes are:
Security Improvements:
html_escapeshell function in.github/workflows/job-send-notification.ymlto sanitize dynamic values before embedding them in email templates, mitigating risks of HTML/attribute injection. [1] [2]GITHUB_ACTOR,BRANCH_NAME, andINPUT_RESOURCE_GROUP_NAME) to use their HTML-escaped versions (e.g.,ACTOR,BRANCH,RESOURCE_GROUP) in both the shell scripts and the email templates. [1] [2] [3] [4] [5]Email Template Consistency:
${ACTOR},${BRANCH},${RESOURCE_GROUP}) instead of the raw workflow inputs, ensuring consistent and secure rendering of user-supplied data in all notification scenarios. [1] [2] [3] [4] [5] [6]These changes collectively improve the robustness and security of the workflow's email notifications.
Does this introduce a breaking change?
Golden Path Validation
Deployment Validation
What to Check
Verify that the following are valid
Other Information