fix(review): harden changed-files summary rendering by JSONbored · Pull Request #3990 · JSONbored/loopover

JSONbored · 2026-07-07T09:13:56Z

Motivation

The per-file changed-files table rendered untrusted PR filenames directly into a public Markdown table, allowing CR/LF and other control characters to break the table and inject attacker-controlled Markdown.
Large PRs or long filenames could exceed GitHub comment size limits because there was no cap on per-file rows or rendered body length.

Description

Neutralize ASCII control characters (including CR/LF) in file paths by replacing them with a safe replacement character before rendering.
Use a variable-length Markdown code-span fence computed from the longest backtick run in the filename so filenames containing backticks remain contained.
Continue escaping backslash/pipe and angle brackets for table/HTML safety, and introduce constants MAX_CHANGED_FILE_DIFF_ROWS and MAX_CHANGED_FILES_DIFF_BODY_LENGTH to bound per-file rendering.
When the per-file row count or rendered body would exceed caps, fall back to the grouped category summary (byte-identical former behavior) instead of emitting an oversized per-file table, and add regression tests covering CR/LF neutralization and the fallbacks.

Testing

Ran the focused unit suite npx vitest run test/unit/changed-files-summary-collapsible.test.ts --pool=forks --reporter=dot and the modified tests passed locally (21 tests passed in that file).
Typecheck npm run typecheck completed successfully with no TypeScript errors.
git diff --check produced no whitespace/conflict errors in the working tree.
Full coverage run npm run test:coverage did not complete cleanly in this environment due to unrelated timeouts in other test suites, and a targeted coverage remapping run failed with a coverage tool error (TypeError: jsTokens is not a function) during report generation; these issues are external to the change and unrelated to the new logic.
npm audit --audit-level=moderate could not reach the registry audit endpoint (received HTTP 403) in this environment, so the local audit did not complete.

Codex Task

superagent-security · 2026-07-07T09:15:39Z

Superagent didn't find any vulnerabilities or security issues in this PR.

loopover-orb · 2026-07-07T09:20:56Z

Caution

🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥🟥

🛑 Gittensory review result - fixes required

_{Review updated: 2026-07-07 11:09:13 UTC}

3 files · 2 blockers · readiness 93/100 · CI failing · blocked

🛑 Suggested Action - Manual Review

No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

Why this is blocked

No linked issue detected — If this PR is intended to solve an issue, link it explicitly in the PR body.
Maintainer requires a linked issue — Link the relevant issue (for example Closes #123) before opening the PR.

CI checks failing

validate
validate-code

Signal	Result	Evidence
Code review	❌ 2 blockers	No AI review summary
Linked issue	⚠️ Missing	No linked issue or no-issue rationale found.
Related work	✅ No active overlap found	No same-issue or scoped active PR overlap found.
Change scope	✅ 20/20	Low review scope from cached public metadata (no linked issue context).
Validation posture	✅ 25/25	PR body includes validation/test evidence.
Contributor workload	✅ 10/10	Author activity: 51 registered-repo PR(s), 43 merged, 569 issue(s).
Contributor context	✅ Confirmed Gittensor contributor	JSONbored; Gittensor profile; 51 PR(s), 569 issue(s).
Gate result	❌ Blocking	Repo-configured hard blocker found.

Review context

Author: JSONbored
Role context: owner (maintainer lane)
Public audience mode: oss maintainer
Lane context: Repository is configured for direct PR review.
Public profile languages: Python, TypeScript, JavaScript, Ruby, Go, Kotlin, MDX, Shell
Official Gittensor activity: 51 PR(s), 569 issue(s).
PR-specific overlap: none found.

Contributor next steps

Treat this as maintainer-lane context rather than normal contributor-lane activity.
Explain no-issue PR.
Link the issue being solved, or explicitly explain why this is a no-issue PR.

Signal definitions

Related work = same linked issue, overlapping active PRs, or title/path similarity.
Change scope = cached public metadata such as size labels, draft state, and review-burden hints.
Validation posture = whether the PR provides enough public validation/test evidence for maintainer review.
Contributor workload = public contributor activity and cleanup pressure, not a repo-wide quality failure.
Contributor context = public GitHub/Gittensor identity context; non-Gittensor status is not a blocker.

_{🟩 Safe / merged · 🟦 Advisory · 🟨 Held for review · 🟥 Blocked / closed}

💰 Earn for open-source contributions like this. Gittensor lets GitHub contributors earn for the work they already do — register to start earning →.

Checked by Gittensory, a quiet PR intelligence layer for OSS maintainers.

Re-run Gittensory review

codecov · 2026-07-07T09:21:23Z

❌ 51 Tests Failed:

Tests completed	Failed	Passed	Skipped
10420	51	10369	7

View the top 3 failed test(s) by shortest run time

test/unit/mcp-server-telemetry.test.ts > MCP server telemetry > records session-scoped MCP request errors without a tool name

Stack Traces | 0.00992s run time

Error: Failed to resolve entry for package "@jsonbored/gittensory-engine". The package may have incorrect main/module/exports specified in its package.json.
 ❯ .../gittensory-miner/lib/opportunity-fanout.js:2:1
 ❯ src/mcp/find-opportunities.ts:11:1

test/unit/mcp-server-telemetry.test.ts > MCP server telemetry > falls back when Hono does not expose an execution context

Stack Traces | 0.0111s run time

Error: Failed to resolve entry for package "@jsonbored/gittensory-engine". The package may have incorrect main/module/exports specified in its package.json.
 ❯ .../gittensory-miner/lib/opportunity-fanout.js:2:1
 ❯ src/mcp/find-opportunities.ts:11:1

test/unit/mcp-server-telemetry.test.ts > MCP server telemetry > records sanitized error telemetry when the MCP transport handler throws

Stack Traces | 0.169s run time

Error: Failed to resolve entry for package "@jsonbored/gittensory-engine". The package may have incorrect main/module/exports specified in its package.json.
 ❯ .../gittensory-miner/lib/opportunity-fanout.js:2:1
 ❯ src/mcp/find-opportunities.ts:11:1

View the full list of 48 ❄️ flaky test(s)

test/integration/api.test.ts > test/integration/api.test.ts