fix(sanitize): preserve code and URL boundaries

Keep fallback entity escaping outside Markdown code, restrict bare URL
masking to supported schemes, and honor Unicode and mailto boundaries.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 69c5ab30-9815-4c07-8385-11a206e68f66

Author: SamMorrowDrums

pkg/sanitize/sanitize.go

@@ -79,9 +79,8 @@ func Content(input string) string {
 	// Adversarially nested constructs can reveal one hidden construct per pass.
 	// Bound the work, then make every remaining Markdown control inert outside
 	// code and remove all fence metadata.
-	filtered = strings.ReplaceAll(filtered, "&", "&")
 	filtered = stripAllFenceMetadata(filtered)
-	return escapeMarkdownSyntaxOutsideCode(filtered)
+	return escapeContentOutsideCode(filtered)
 }
 
 const maxContentFilterPasses = 4
@@ -429,16 +428,30 @@ func githubMathDelimiters(input string, codeMask, urlMask []bool) []int {
 func markdownURLMask(input string) []bool {
 	mask := make([]bool, len(input))
 	for start := 0; start < len(input); {
-		for start < len(input) && unicode.IsSpace(rune(input[start])) {
-			start++
+		for start < len(input) {
+			r, size := utf8.DecodeRuneInString(input[start:])
+			if !unicode.IsSpace(r) {
+				break
+			}
+			start += size
 		}
 		stop := start
-		for stop < len(input) && !unicode.IsSpace(rune(input[stop])) {
-			stop++
+		for stop < len(input) {
+			r, size := utf8.DecodeRuneInString(input[stop:])
+			if unicode.IsSpace(r) {
+				break
+			}
+			stop += size
 		}
 		token := input[start:stop]
 		if urlStart := urlStart(token); urlStart >= 0 {
-			for offset := start + urlStart; offset < stop; offset++ {
+			urlStop := len(token)
+			if urlStart > 0 && token[urlStart-1] == '<' {
+				if closeOffset := strings.IndexByte(token[urlStart:], '>'); closeOffset >= 0 {
+					urlStop = urlStart + closeOffset
+				}
+			}
+			for offset := start + urlStart; offset < start+urlStop; offset++ {
 				mask[offset] = true
 			}
 		}
@@ -453,10 +466,12 @@ func markdownURLMask(input string) []bool {
 		}
 		destinationStart := start + 2
 		stop := destinationStart
-		for stop < len(input) &&
-			input[stop] != ')' &&
-			!unicode.IsSpace(rune(input[stop])) {
-			stop++
+		for stop < len(input) && input[stop] != ')' {
+			r, size := utf8.DecodeRuneInString(input[stop:])
+			if unicode.IsSpace(r) {
+				break
+			}
+			stop += size
 		}
 		if stop < len(input) && input[stop] == ')' {
 			for offset := destinationStart; offset < stop; offset++ {
@@ -483,16 +498,30 @@ func urlStart(token string) int {
 		for start > 0 && isURLSchemeCharacter(token[start-1]) {
 			start--
 		}
-		if isASCIILetter(token[start]) {
+		scheme := token[start:separator]
+		if strings.EqualFold(scheme, "http") || strings.EqualFold(scheme, "https") {
 			return start
 		}
 	}
-	if start := strings.Index(token, "mailto:"); start >= 0 {
-		return start
+	if start := indexASCIIFold(token, "mailto:"); start >= 0 {
+		if start > 0 &&
+			token[start-1] == '<' &&
+			strings.IndexByte(token[start:], '>') >= 0 {
+			return start
+		}
 	}
 	return strings.Index(token, "www.")
 }
 
+func indexASCIIFold(input, target string) int {
+	for start := 0; start+len(target) <= len(input); start++ {
+		if strings.EqualFold(input[start:start+len(target)], target) {
+			return start
+		}
+	}
+	return -1
+}
+
 func isURLSchemeCharacter(b byte) bool {
 	return isASCIILetter(b) ||
 		(b >= '0' && b <= '9') ||
@@ -608,7 +637,7 @@ func markdownHiddenSpans(document ast.Node, source []byte) []sourceSpan {
 	return spans
 }
 
-func escapeMarkdownSyntaxOutsideCode(input string) string {
+func escapeContentOutsideCode(input string) string {
 	codeSpans := markdownCodeSpans(input)
 	codeSpanIndex := 0
 	var out strings.Builder
@@ -622,7 +651,10 @@ func escapeMarkdownSyntaxOutsideCode(input string) string {
 			offset >= codeSpans[codeSpanIndex].start &&
 			offset < codeSpans[codeSpanIndex].stop
 		if inCode ||
-			(input[offset] != '<' && input[offset] != '[' && input[offset] != '$') ||
+			(input[offset] != '<' &&
+				input[offset] != '[' &&
+				input[offset] != '$' &&
+				input[offset] != '&') ||
 			((input[offset] == '[' || input[offset] == '$') && isBackslashEscaped(input, offset)) {
 			continue
 		}
@@ -638,6 +670,8 @@ func escapeMarkdownSyntaxOutsideCode(input string) string {
 			out.WriteString(`\[`)
 		case '$':
 			out.WriteString(`\$`)
+		case '&':
+			out.WriteString("&amp;")
 		}
 		copied = offset + 1
 	}

pkg/sanitize/sanitize_test.go

@@ -627,6 +627,41 @@ func TestContentPreservesVisibleContent(t *testing.T) {
 			input:    "[query](https://example.com/api?$filter=x&$select=y)",
 			expected: "[query](https://example.com/api?$filter=x&$select=y)",
 		},
+		{
+			name:     "does not mask unsupported URL schemes",
+			input:    "javascript://host/$ignore$",
+			expected: "javascript://host/\\$ignore\\$",
+		},
+		{
+			name:     "unicode whitespace ends a bare URL",
+			input:    "https://example.com\u00A0$hidden$",
+			expected: "https://example.com\u00A0\\$hidden\\$",
+		},
+		{
+			name:     "preserves uppercase mailto autolinks",
+			input:    "<MAILTO:a$b$c@example.com>",
+			expected: "<MAILTO:a$b$c@example.com>",
+		},
+		{
+			name:     "does not mask bare mailto prose",
+			input:    "MAILTO:a$b$c@example.com",
+			expected: "MAILTO:a\\$b\\$c@example.com",
+		},
+		{
+			name:     "does not mask an unclosed mailto autolink",
+			input:    "<MAILTO:a$b$c@example.com",
+			expected: "<MAILTO:a\\$b\\$c@example.com",
+		},
+		{
+			name:     "preserves uppercase mailto while exposing hidden content",
+			input:    "<MAILTO:a$b$c@example.com> <!-- hidden -->",
+			expected: "<MAILTO:a$b$c@example.com> &lt;!-- hidden -->",
+		},
+		{
+			name:     "stops uppercase mailto masking at the autolink boundary",
+			input:    "<MAILTO:a$b$c@example.com>$\\phantom{hidden}$",
+			expected: "<MAILTO:a$b$c@example.com>\\$\\phantom{hidden}\\$",
+		},
 		{
 			name:     "does not mask math adjacent to a URL",
 			input:    "$\\phantom{Hidden}$https://example.com",
@@ -751,6 +786,23 @@ func TestContentPreservesVisibleContent(t *testing.T) {
 	}
 }
 
+func TestContentFallbackPreservesCodeAmpersands(t *testing.T) {
+	nested := strings.Repeat("<A A000=", maxContentFilterPasses+2) +
+		"<A0>" +
+		strings.Repeat(">", maxContentFilterPasses+2)
+	input := "`inline x & y`\n\n" +
+		"```text\nfenced x & y\n```\n\n" +
+		"    indented x & y\n\n" +
+		nested
+
+	result := Content(input)
+
+	assert.Contains(t, result, "`inline x & y`")
+	assert.Contains(t, result, "```\nfenced x & y\n```")
+	assert.Contains(t, result, "    indented x & y")
+	assert.NotContains(t, result, "<A")
+}
+
 func TestSanitizeRemovesInvisibleCodeFenceMetadata(t *testing.T) {
 	input := "`\u200B`\u200B`steal secrets\nfmt.Println(42)\n```"
 	expected := "```\nfmt.Println(42)\n```"