From ce194c5692adcd6204565abcf1428e915ec95570 Mon Sep 17 00:00:00 2001
From: Bob Brown <bobbrow@microsoft.com>
Date: Tue, 5 May 2026 11:11:19 -0700
Subject: [PATCH 1/2] address codeQL issues

---
 .github/actions/common/utils.ts | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/.github/actions/common/utils.ts b/.github/actions/common/utils.ts
index e46ca0a68..4661ca0ba 100644
--- a/.github/actions/common/utils.ts
+++ b/.github/actions/common/utils.ts
@@ -25,7 +25,6 @@ export const normalizeIssue = (issue: {
 	const cleanse = (str: string) => {
 		let out = str
 			.toLowerCase()
-			.replace(/<!--.*-->/gu, '')
 			.replace(/.* version: .*/gu, '')
 			.replace(/issue type: .*/gu, '')
 			.replace(/vs ?code/gu, '')
@@ -36,6 +35,12 @@ export const normalizeIssue = (issue: {
 			.replace(/\s+/gu, ' ')
 			.replace(/```[^`]*?```/gu, '');
 
+		while (
+			out.includes('<!--') &&
+			out.includes('-->') &&
+			out.indexOf('-->') > out.indexOf('<!--')) {
+			out = out.slice(0, out.indexOf('<!--')) + out.slice(out.indexOf('-->') + 3);
+		}
 		while (
 			out.includes(`<details>`) &&
 			out.includes('</details>') &&
@@ -116,9 +121,9 @@ Repo: ${context.repo.owner}/${context.repo.repo}
 
 <!-- Context:
 ${JSON.stringify(context, null, 2)
-	.replace(/<!--/gu, '<@--')
-	.replace(/-->/gu, '--@>')
-	.replace(/\/|\\/gu, 'slash-')}
+				.replace(/<!--/gu, '<@--')
+				.replace(/-->/gu, '--@>')
+				.replace(/\/|\\/gu, 'slash-')}
 -->
 `);
 };

From 805230319dab804fc8ddae62d1ac4e2fc150f292 Mon Sep 17 00:00:00 2001
From: Bob Brown <bobbrow@users.noreply.github.com>
Date: Tue, 5 May 2026 11:51:42 -0700
Subject: [PATCH 2/2] Potential fix for pull request finding 'CodeQL / Bad HTML
 filtering regexp'

Apparently we need to handle invalid comment ending that the HTML parser will mark as errors but handle correctly anyway.

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 .github/actions/common/utils.ts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/actions/common/utils.ts b/.github/actions/common/utils.ts
index 4661ca0ba..b1180f850 100644
--- a/.github/actions/common/utils.ts
+++ b/.github/actions/common/utils.ts
@@ -122,7 +122,7 @@ Repo: ${context.repo.owner}/${context.repo.repo}
 <!-- Context:
 ${JSON.stringify(context, null, 2)
 				.replace(/<!--/gu, '<@--')
-				.replace(/-->/gu, '--@>')
+				.replace(/--!?\s*>/gu, '--@>')
 				.replace(/\/|\\/gu, 'slash-')}
 -->
 `);