Address Copilot PR review comments on prompt injection hardening

- Escape rationale object keys through escapeMd in auto-triage-issues.yml;
  previously only values were escaped, leaving LLM-derived keys as a
  markdown injection vector.
- Move issue_title/issue_body sanitisation into get_fix_instructions so the
  function owns the safety contract for its own <user_content> delimiter;
  callers no longer need to pre-sanitise these fields.
- Update test_issue_body_truncated to use MAX_ISSUE_BODY_LENGTH boundary and
  remove the stale 1500-char / "..." assertions.
- Update test_xml_escaped_title_appears_inside_user_content to pass a raw
  title (matching the new caller contract) and assert the escaped form.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: sellakumaran

.github/workflows/auto-triage-issues.yml

@@ -111,7 +111,7 @@ jobs:
             if (triageResult.rationale) {
               if (typeof triageResult.rationale === 'object') {
                 rationaleText = Object.entries(triageResult.rationale)
-                  .map(([key, value]) => `**${key.replace(/_/g, ' ')}:** ${escapeMd(value)}`)
+                  .map(([key, value]) => `**${escapeMd(key.replace(/_/g, ' '))}:** ${escapeMd(value)}`)
                   .join('\n\n');
               } else {
                 rationaleText = escapeMd(triageResult.rationale);

autoTriage/services/copilot_service.py

@@ -9,7 +9,12 @@
 import subprocess
 import json
 from typing import Dict, Any
-from utils.sanitise import MAX_SUGGESTION_LENGTH, sanitise_user_content as _sanitise_user_content
+from utils.sanitise import (
+    MAX_ISSUE_BODY_LENGTH,
+    MAX_ISSUE_TITLE_LENGTH,
+    MAX_SUGGESTION_LENGTH,
+    sanitise_user_content as _sanitise_user_content,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -376,19 +381,21 @@ def get_fix_instructions(
         # fix_suggestions are generated by an upstream LLM from untrusted issue content
         # and must be treated as untrusted too — an attacker can steer that LLM to emit
         # malicious suggestions that would otherwise appear as trusted instructions.
+        # Sanitise title and body here so callers do not need to pre-sanitise.
+        # get_fix_instructions owns the <user_content> delimiter, so it must also
+        # own the sanitisation of everything placed inside it.
+        safe_title = _sanitise_user_content(issue_title, max_length=MAX_ISSUE_TITLE_LENGTH) if issue_title else ""
+        safe_body = _sanitise_user_content(issue_body, max_length=MAX_ISSUE_BODY_LENGTH) if issue_body else ""
+
         instructions.append("<user_content>")
-        if issue_title:
-            instructions.append(f"Issue: {issue_title}")
+        if safe_title:
+            instructions.append(f"Issue: {safe_title}")
             instructions.append("")
 
-        # Include issue body (truncated for reasonable instruction length)
-        if issue_body:
-            # Truncate body to 1500 chars to keep instructions manageable
-            truncated_body = issue_body[:1500]
-            if len(issue_body) > 1500:
-                truncated_body += "..."
+        # Include issue body (truncated by sanitise_user_content)
+        if safe_body:
             instructions.append("Description:")
-            instructions.append(truncated_body)
+            instructions.append(safe_body)
             instructions.append("")
 
         if fix_suggestions:

autoTriage/tests/services/test_copilot_service.py

@@ -714,20 +714,21 @@ def test_issue_body_included(self):
 
     # Test: Long issue body is truncated
     def test_issue_body_truncated(self):
-        """Test that very long issue bodies are truncated."""
+        """Test that very long issue bodies are truncated to MAX_ISSUE_BODY_LENGTH."""
         from services.copilot_service import CopilotService
-        
+        from utils.sanitise import MAX_ISSUE_BODY_LENGTH
+
         service = CopilotService()
-        long_body = "A" * 2000  # Longer than 1500 char limit
+        long_body = "A" * (MAX_ISSUE_BODY_LENGTH + 500)
         instructions = service.get_fix_instructions(
             issue_title="Test",
             issue_body=long_body,
             fix_suggestions=[]
         )
-        
-        assert "..." in instructions
-        # Should have truncated content
-        assert "A" * 1500 in instructions
+
+        # sanitise_user_content truncates at MAX_ISSUE_BODY_LENGTH (no "..." suffix)
+        assert "A" * MAX_ISSUE_BODY_LENGTH in instructions
+        assert "A" * (MAX_ISSUE_BODY_LENGTH + 1) not in instructions
 
     # Test: Suggestion numbering
     def test_suggestions_are_numbered(self):
@@ -873,21 +874,22 @@ def test_dependency_constraint_always_present(self, suggestions):
             f"Dependency constraint missing when fix_suggestions={suggestions!r}"
 
     def test_xml_escaped_title_appears_inside_user_content(self):
-        """A title with XML special chars that was sanitized upstream stays inside user_content."""
+        """A title with XML special chars is sanitised by get_fix_instructions and stays inside user_content."""
         from services.copilot_service import CopilotService
 
         service = CopilotService()
-        # Simulate a title that has already been XML-escaped by _sanitise_user_content
-        sanitized_title = "<script>alert(1)</script> fix typo"
+        # Pass raw (unsanitised) title — get_fix_instructions now owns the sanitisation.
+        raw_title = "<script>alert(1)</script> fix typo"
+        escaped_title = "&lt;script&gt;alert(1)&lt;/script&gt; fix typo"
         instructions = service.get_fix_instructions(
-            issue_title=sanitized_title,
+            issue_title=raw_title,
             issue_body="",
             fix_suggestions=[]
         )
 
         open_pos = instructions.index("<user_content>")
         close_pos = instructions.index("</user_content>")
-        title_pos = instructions.index(sanitized_title)
+        title_pos = instructions.index(escaped_title)
         assert open_pos < title_pos < close_pos, \
             "Escaped title must remain inside user_content block"