fix: fixed copilot comments - #603
Merged
Prajwal-Microsoft merged 2 commits intoMay 25, 2026
Merged
Prajwal-Microsoft merged 2 commits into
Prajwal-Microsoft merged 2 commits into
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request hardens the GitHub Actions email-notification workflow by HTML-escaping dynamic, workflow-sourced values before embedding them into HTML email templates, reducing the risk of HTML/attribute injection.
Changes:
- Added an html_escape shell helper in notification steps and used it to sanitize actor/branch/resource-group values.
- Updated email templates to reference the sanitized variables (${ACTOR}, ${BRANCH}, ${RESOURCE_GROUP}) instead of raw workflow/context values.
- Applied the escaped variables consistently across failure/success notification variants.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Sorry, something went wrong.
Comment thread
.github/workflows/job-send-notification.yml
Outdated
Prajwal-Microsoft
approved these changes
May 25, 2026
Copy link
Copy Markdown
|
🎉 This PR is included in version 2.1.0 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Sorry, something went wrong.
pull Bot
pushed a commit
to ScorpiusDraconis83/content-processing-solution-accelerator
that referenced
this pull request
Aug 10, 2026
NPM (ContentProcessorWeb pnpm overrides): - websocket-driver -> ^0.7.5 (CRITICAL, microsoft#541) - axios 1.16.0 -> 1.18.0 (microsoft#558) - brace-expansion ^2.0.3 -> ^2.1.2 (microsoft#587) - fast-uri 3.1.2 -> 3.1.4 (microsoft#602/microsoft#604) - immutable ^5.1.5 -> ^5.1.8 (microsoft#600/microsoft#601) - js-yaml ^4.2.0 -> ^4.3.0 (microsoft#588) - shell-quote ^1.8.4 -> ^1.9.0 (microsoft#589) - svgo ^2.8.1 -> ^2.8.3 (microsoft#603) - react-router-dom 7.15.1 -> 7.18.1 (microsoft#611 DoS) Python (uv): - pillow 12.2.0 -> 12.3.0 (ContentProcessor) - pyasn1 0.6.3 -> 0.6.4 (ContentProcessor, Workflow) - mcp 1.25.0 -> 1.28.1 (Workflow); transitive mcp -> 1.29.0 (ContentProcessor) Deferred: react-router microsoft#610 (RSC CSRF, fixed only in v8.3.0 major; RSC mode unused by this CRA SPA). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 22668762-66d8-4311-b4c2-ee147376b71d
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Purpose
This pull request enhances the security of the email notification workflow by ensuring that dynamic values embedded in email templates are properly HTML-escaped. This prevents potential HTML or attribute injection vulnerabilities from workflow inputs such as actor names, branch names, and resource group names. Additionally, the workflow now consistently uses these escaped variables throughout the email templates for all notification scenarios.
The most important changes are:
Security Improvements:
Email Template Consistency:
These changes collectively improve the robustness and security of the workflow's email notifications.
Does this introduce a breaking change?
Golden Path Validation
Deployment Validation
What to Check
Verify that the following are valid
Other Information