Sanitize automation tag names and descriptions

Tag names and descriptions are user-authored, so list results apply the
same PlainText and Content filters used for release names and bodies.

Author: notapopsicle

pkg/github/automation_tags.go

@@ -8,6 +8,7 @@ import (
 
 	ghErrors "github.com/github/github-mcp-server/v2/pkg/errors"
 	"github.com/github/github-mcp-server/v2/pkg/inventory"
+	"github.com/github/github-mcp-server/v2/pkg/sanitize"
 	"github.com/github/github-mcp-server/v2/pkg/scopes"
 	"github.com/github/github-mcp-server/v2/pkg/translations"
 	"github.com/github/github-mcp-server/v2/pkg/utils"
@@ -97,8 +98,16 @@ func ListAutomationTags(t translations.TranslationHelperFunc) inventory.ServerTo
 			if resp.StatusCode != http.StatusOK {
 				return ghErrors.NewGitHubAPIStatusErrorResponse(ctx, "failed to list automation tags", resp, nil), nil, nil
 			}
+			for i := range output.Tags {
+				sanitizeAutomationTagNameAndDescription(&output.Tags[i])
+			}
 			output.NextPage = resp.NextPage
 			return MarshalledTextResult(&output), &output, nil
 		},
 	)
 }
+
+func sanitizeAutomationTagNameAndDescription(tag *AutomationTag) {
+	tag.Name = sanitize.PlainText(tag.Name)
+	tag.Description = sanitize.Content(tag.Description)
+}

pkg/github/automation_tags_test.go

@@ -128,6 +128,12 @@ func Test_ListAutomationTags(t *testing.T) {
 					escapedPath: "/agents/repos/own%20er%2Fteam/re%2Fpo/automation-tags",
 					want:        `{"tags":[],"total_count":0,"nextPage":0}`,
 				},
+				{
+					name:   "sanitized name and description",
+					status: http.StatusOK,
+					body:   `{"tags":[{"id":"tag-1","name":"<script>alert(1)</script>Hello\u200bWorld","description":"<script>alert(1)</script>Hello\u200bWorld","version":"v1","created_at":"","updated_at":""}],"total_count":1}`,
+					want:   `{"tags":[{"id":"tag-1","name":"HelloWorld","description":"<script>alert(1)</script>HelloWorld","version":"v1","created_at":"","updated_at":""}],"total_count":1,"nextPage":0}`,
+				},
 				{name: "non-disclosure", status: http.StatusNotFound, body: `{"message":"Not Found"}`, wantError: "404"},
 				{name: "empty denial", status: http.StatusNotFound, wantError: "404"},
 				{name: "bad request", status: http.StatusBadRequest, body: `{"message":"Bad Request"}`, wantError: "400"},