fix: strip null bytes from gateway.md before writing to step summary#39910
Conversation
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR defensively sanitizes gateway.md step-summary rendering by stripping null bytes (U+0000) from the gateway.md content before writing it to core.summary, preventing GitHub’s renderer from producing large blocks of U+FFFD replacement characters.
Changes:
- Strip
\x00bytes fromgateway.mdcontent immediately after reading inparse_mcp_gateway_log.cjs. - Add a regression test that simulates MCPG’s leading null-byte header region and asserts the step summary contains no null bytes while preserving real content.
- Update generated workflow lock config related to MCP safe-outputs server startup.
Show a summary per file
| File | Description |
|---|---|
| actions/setup/js/parse_mcp_gateway_log.cjs | Sanitizes gateway.md content by removing null bytes before writing to the step summary. |
| actions/setup/js/parse_mcp_gateway_log.test.cjs | Adds regression coverage for null-byte stripping behavior in step-summary output. |
| actions/setup-cli/install.sh | Adjusts header comment about how this installer script is kept in sync. |
| .github/workflows/daily-formal-spec-verifier.lock.yml | Updates generated MCP config snippet (safe-outputs entrypoint wrapper + env shaping). |
Copilot's findings
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 4/4 changed files
- Comments generated: 2
| fs.existsSync = originalExistsSync; | ||
| fs.readFileSync = originalReadFileSync; | ||
| delete global.core; | ||
| } finally { | ||
| fs.rmSync(tmpDir, { recursive: true, force: true }); | ||
| } |
| set +o histexpand | ||
|
|
||
| # Kept in sync with ../../install-gh-aw.sh — edit that file, then copy here. | ||
| # Kept in sync with actions/setup-cli/install.sh — edit this file, then copy to that path. |
|
@copilot run pr-finisher skill |
…mment in install.sh Co-authored-by: pelikhan <4175913+pelikhan@users.noreply.github.com>
Done. Both issues from the automated review have been addressed in commit
All 10,710 JS tests pass locally. |
Every
gateway.mdproduced by MCPG (gh-aw-firewall) starts with 1444–1537 leading\x00bytes — a pre-allocated header region that is never filled in.parse_mcp_gateway_log.cjswas writing this content directly tocore.summary.addRaw(), and GitHub's HTML5 renderer replaces U+0000 → U+FFFD, producing hundreds of\uFFFDreplacement characters at the top of every step summary.Changes
parse_mcp_gateway_log.cjs— strip null bytes fromgateway.mdcontent immediately after reading:parse_mcp_gateway_log.test.cjs— add regression test: writes agateway.mdwith 1444 leading null bytes (matching production artifact) and asserts step-summary output contains no null bytes while preserving real content.