Skip to content

fix: keep surrogate numeric character references from failing the mail list - #183

Open
charan-rathore wants to merge 1 commit into
CopilotKit:mainfrom
charan-rathore:fix/snippet-surrogate-entities
Open

charan-rathore wants to merge 1 commit into
CopilotKit:mainfrom
charan-rathore:fix/snippet-surrogate-entities

Conversation

@charan-rathore

Copy link
Copy Markdown
Contributor

Summary

decodeSnippet decodes numeric character references with String.fromCodePoint, which throws a RangeError for surrogate code points (0xD800-0xDFFF). The range check only excluded values above 0x10FFFF. A sender can put the literal text � in a message - someone discussing HTML entities, for example - and when that message falls back to its snippet, the throw rejects the Promise.all in listMail, so one message breaks the whole inbox list. The same unpaired-surrogate input class is already handled for attachment filenames and URI encoding (wellFormed); the snippet decoder missed it.

Fix

Treat surrogate code points as invalid alongside the out-of-range ones, leaving the reference literal - the same fallback the decoder already uses for values it cannot represent.

Test

a numeric character reference to a surrogate stays literal instead of failing the list fails on main with the uncaught RangeError and passes with the range narrowed. The full tests/google.test.ts suite passes (38/38), and tsc --noEmit and biome check are clean.

…l list

Signed-off-by: Charan Rathore <180254320+charan-rathore@users.noreply.github.com>
@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Oct 17, 2026 •

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review ✅ Completed 2026-10-17T19:18:51.834005Z 9a70e5f PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9a70e5f345

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

? Number.parseInt(entity.slice(2), 16)
: Number.parseInt(entity.slice(1), 10);
return code >= 0 && code <= 0x10ffff ? String.fromCodePoint(code) : original;
// Surrogates are not scalar values: fromCodePoint throws on them, and one

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Reproduce the actual rejection before guarding surrogates

On the supported Node runtime, String.fromCodePoint(0xd800) returns an unpaired UTF-16 code unit; it does not throw (only nonintegral or out-of-range values do). Consequently, before this patch the fixture reaches Promise.all successfully and the new test fails only at its changed body assertion, so this guard/test cannot demonstrate or fix the claimed whole-inbox rejection. If that rejection is the production regression, reproduce the operation that actually throws (or reframe this as output normalization) so the real failure is not left unresolved.

Useful? React with 👍 / 👎.

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant