Use upstream sanitizers for rename titles and dismissal messages

Rename titles now use sanitize.PlainText like issue titles (#3216), so a
title such as can't "quote" AT&T no longer comes back HTML-escaped. The
dismissal message uses sanitize.Content like review bodies (#3177). The
new converter fields are added to the sanitizer coverage table.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Author: louim

pkg/github/issues_events_test.go

@@ -108,7 +108,7 @@ func Test_GetIssueEvents(t *testing.T) {
 			ID:       new(int64(456)),
 			Event:    new("renamed"),
 			Actor:    &github.User{Login: new("outsider")},
-			Rename:   &github.Rename{From: new("old title"), To: new("new title")},
+			Rename:   &github.Rename{From: new("old title"), To: new(`can't "quote" AT&T`)},
 			CommitID: new("abc123"),
 		},
 	}
@@ -145,7 +145,7 @@ func Test_GetIssueEvents(t *testing.T) {
 					Event:       "renamed",
 					CommitID:    "abc123",
 					RenamedFrom: "old title",
-					RenamedTo:   "new title",
+					RenamedTo:   `can't "quote" AT&T`,
 				},
 			},
 		},
@@ -439,14 +439,14 @@ func Test_GetIssueTimeline_TrimsAndSanitizes(t *testing.T) {
 	assert.NotContains(t, raw[0], "parents")
 }
 
-// Test_GetIssueTimeline_PreservesMarkdown checks that comment bodies and commit messages go
-// through sanitize.Content like get_comments does: Markdown and code survive, invisible
-// characters are stripped.
-func Test_GetIssueTimeline_PreservesMarkdown(t *testing.T) {
+// Test_GetIssueTimeline_PreservesAuthoredText checks that bodies and commit messages keep their
+// Markdown and code, and that rename titles keep quotes and ampersands, as on get_comments and get.
+func Test_GetIssueTimeline_PreservesAuthoredText(t *testing.T) {
 	t.Parallel()
 
 	body := "Render <Foo/> here.\n\n```go\nif a<b {}\n```\n"
 	message := "Fix comparison: if a<b {}"
+	title := `can't "quote" AT&T`
 
 	serverTool := IssueReadWithEvents(translations.NullTranslationHelper)
 	deps := issueEventsDeps(t, MockHTTPClientWithHandlers(map[string]http.HandlerFunc{
@@ -462,6 +462,11 @@ func Test_GetIssueTimeline_PreservesMarkdown(t *testing.T) {
 				SHA:     new("abc123"),
 				Message: new(message),
 			},
+			{
+				Event:  new("renamed"),
+				Actor:  &github.User{Login: new("maintainer")},
+				Rename: &github.Rename{From: new("old title"), To: new(title)},
+			},
 		}),
 	}), false)
 
@@ -477,10 +482,11 @@ func Test_GetIssueTimeline_PreservesMarkdown(t *testing.T) {
 
 	var returned []MinimalTimelineItem
 	require.NoError(t, json.Unmarshal([]byte(getTextResult(t, result).Text), &returned))
-	require.Len(t, returned, 2)
+	require.Len(t, returned, 3)
 
 	assert.Equal(t, body, returned[0].Body)
 	assert.Equal(t, message, returned[1].Message)
+	assert.Equal(t, title, returned[2].RenamedTo)
 }
 
 func Test_GetIssueEvent(t *testing.T) {
@@ -769,8 +775,6 @@ func Test_GetIssueEvent_CarriesDismissedReview(t *testing.T) {
 	assert.Equal(t, "changes_requested", returned.DismissedReview.State)
 	assert.Equal(t, int64(456), returned.DismissedReview.ReviewID)
 	assert.Equal(t, "def456", returned.DismissedReview.DismissalCommitID)
-	// The dismissal message is author-supplied, so it is sanitized like any other body text.
-	assert.NotContains(t, returned.DismissedReview.DismissalMessage, "<script>")
 }
 
 func Test_GetIssueTimeline_CarriesCommitAuthorship(t *testing.T) {

pkg/github/minimal_types.go

@@ -1176,8 +1176,8 @@ func convertToMinimalIssueEvent(event *github.IssueEvent) MinimalIssueEvent {
 		m.Milestone = milestone.GetTitle()
 	}
 	if rename := event.GetRename(); rename != nil {
-		m.RenamedFrom = sanitize.Sanitize(rename.GetFrom())
-		m.RenamedTo = sanitize.Sanitize(rename.GetTo())
+		m.RenamedFrom = sanitize.PlainText(rename.GetFrom())
+		m.RenamedTo = sanitize.PlainText(rename.GetTo())
 	}
 	if issue := event.GetIssue(); issue != nil {
 		ref := newMinimalIssueRef(
@@ -1202,16 +1202,15 @@ func convertToMinimalIssueEvent(event *github.IssueEvent) MinimalIssueEvent {
 		m.DismissedReview = &MinimalDismissedReview{
 			State:             dismissed.GetState(),
 			ReviewID:          dismissed.GetReviewID(),
-			DismissalMessage:  sanitize.Sanitize(dismissed.GetDismissalMessage()),
+			DismissalMessage:  sanitize.Content(dismissed.GetDismissalMessage()),
 			DismissalCommitID: dismissed.GetDismissalCommitID(),
 		}
 	}
 
 	return m
 }
 
-// convertToMinimalTimelineItem trims a REST timeline entry. Bodies and commit messages use
-// sanitize.Content to keep their Markdown intact, matching get_comments.
+// convertToMinimalTimelineItem trims a REST timeline entry.
 func convertToMinimalTimelineItem(item *github.Timeline) MinimalTimelineItem {
 	if item == nil {
 		return MinimalTimelineItem{}
@@ -1250,8 +1249,8 @@ func convertToMinimalTimelineItem(item *github.Timeline) MinimalTimelineItem {
 		m.Milestone = milestone.GetTitle()
 	}
 	if rename := item.GetRename(); rename != nil {
-		m.RenamedFrom = sanitize.Sanitize(rename.GetFrom())
-		m.RenamedTo = sanitize.Sanitize(rename.GetTo())
+		m.RenamedFrom = sanitize.PlainText(rename.GetFrom())
+		m.RenamedTo = sanitize.PlainText(rename.GetTo())
 	}
 	if reviewer := item.GetReviewer(); reviewer != nil {
 		m.RequestedReviewer = reviewer.GetLogin()

pkg/github/sanitize_coverage_test.go

@@ -230,6 +230,49 @@ func Test_MinimalConverters_SanitizeUserAuthoredText(t *testing.T) {
 				}).Title
 			},
 		},
+		{
+			name: "issue event renamed title",
+			got: func() string {
+				return convertToMinimalIssueEvent(&github.IssueEvent{
+					Rename: &github.Rename{From: new(maliciousText)},
+				}).RenamedFrom
+			},
+		},
+		{
+			name:    "issue event dismissal message",
+			content: true,
+			got: func() string {
+				return convertToMinimalIssueEvent(&github.IssueEvent{
+					DismissedReview: &github.DismissedReview{DismissalMessage: new(maliciousText)},
+				}).DismissedReview.DismissalMessage
+			},
+		},
+		{
+			name: "timeline renamed title",
+			got: func() string {
+				return convertToMinimalTimelineItem(&github.Timeline{
+					Rename: &github.Rename{To: new(maliciousText)},
+				}).RenamedTo
+			},
+		},
+		{
+			name:    "timeline comment body",
+			content: true,
+			got: func() string {
+				return convertToMinimalTimelineItem(&github.Timeline{
+					Body: new(maliciousText),
+				}).Body
+			},
+		},
+		{
+			name:    "timeline commit message",
+			content: true,
+			got: func() string {
+				return convertToMinimalTimelineItem(&github.Timeline{
+					Message: new(maliciousText),
+				}).Message
+			},
+		},
 	}
 
 	for _, tt := range tests {