fix: roll up contributor validation, HTML, and release gate fixes#403
Merged
Conversation
The _contains_suspicious_content regex [^\x00-\x7F]{50,} was designed
to catch binary/encoded content but also rejects legitimate CJK
(Japanese, Chinese, Korean) clinical text, which doesn't use spaces
between words. Japanese is an explicitly supported PII language.
Replace the blanket non-ASCII rejection with a targeted check for
control characters only ([\x00-\x08\x0e-\x1f\x7f]{10,}).
The existing checks for repeated characters (100+) and excessive
special char ratio (>0.5) already catch real binary/encoded content.
Fixes #391
…t XSS The to_html method inserted user-controlled values (result.text, entity.label, entity.text, result.model_name, result.timestamp) directly into HTML without escaping. This allows cross-site scripting when the HTML output is rendered in a browser. Add html.escape() to all user-controlled values before embedding them in HTML. Use 'import html as html_mod' to avoid shadowing the local 'html' variable used for building the output string. Fixes #392
…396) When the nightly cron runs the release-gates workflow without a candidate report file (artifacts/release-candidate.json), the gate harness previously raised FileNotFoundError which was caught by the generic exception handler and opened a spurious tracking issue. Changes: - Add early file-existence check in main() that exits cleanly (rc=0) when the candidate report file does not exist, instead of letting FileNotFoundError propagate to the issue-creating error handler. - Update the release-gates workflow to check for the candidate file before running the gate, skipping all gate steps when absent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Verification
1614 passed, 1 skipped)Closes #391
Closes #392
Closes #396