Sign in

Evidencesanitize-html-464

Escaping input with unclosed, invalid tags returns it with unneeded escaped closing tags appended to end

sanitize-html#464, at commit f12a665. A closed issue from a repository Credda did not choose.

LIVE2026-09-20

RIGHT_FAILURE

executed against the upstream checkout.

Outcome
REPRODUCED_AND_DIAGNOSED
Wall time
96.1s
Checks
5 passed of 5 applicable

RECORDED

NOT_GRADED

graded from the transcript committed with this case.

Outcome
not recorded
Checks
none run
Repository
apostrophecms/sanitize-html
Issue
#464
Pinned commit
f12a665e6fca1eef5336287d8b453bd7501a66b4

01The signal

The report, exactly as it was filed.

Nothing paraphrased or cleaned up. The mess is the thing under test.

sanitize-html#464 · as filedcommit f12a665

Escaping input with unclosed, invalid tags returns it with unneeded escaped closing tags appended to end

## To Reproduce

From the Node REPL:
```
> const s = require('sanitize-html')
undefined
> s("here's a string with a <wacky> tag.", {disallowedTagsMode: "escape"})
"here's a string with a &lt;wacky&gt; tag.&lt;/wacky&gt;"
```

## Expected behavior

The offending tag is escaped, but no addition markup is created. For example, given the input `here's a string with a <wacky> tag`, I would expect the output to be: `here's a string with a &lt;wacky&gt; tag`

## Describe the bug

When sanitizing a string with `disallowedTagsMode: "escape"`, extra, unneeded (escaped) closing tags are appended to the end of the string.

## Details

**Version of Node.js:** 15.5.0
**Server Operating System:** Ubuntu 20.04
Issue
#464
Commit
f12a665e6fca1eef5336287d8b453bd7501a66b4
Why this commit
The first parent of the fix commit d5fbdc661574d57baf94d78106ee8dea477b0cb5, which GitHub binds to this issue via CLOSED_EVENT_PR. Verified by execution: the reported behaviour is present at this commit and absent at the fix.
How the text was obtained
Fetched verbatim via the GitHub GraphQL API. Title on the first line, body unmodified below it. Nothing was paraphrased, cleaned up, or supplemented.
Toolchain
javascript · node · unknown · npm

02What counts as reproducing it

The bar, written down before the run.

expected.reportedFailurecommitted with the case
Symptom
s("here's a string with a <wacky> tag.", {disallowedTagsMode: "escape"}) produces "here's a string with a &lt;wacky&gt; tag.&lt;/wacky&gt;"; the fix makes it produce "here's a string with a &lt;wacky&gt; tag.".
Expression
s("here's a string with a <wacky> tag.", {disallowedTagsMode: "escape"})
Reported output
"here's a string with a &lt;wacky&gt; tag.&lt;/wacky&gt;"
Where that came from
Read mechanically from the report's fenced code, REPL form: `> s("here's a string with a <wacky> tag.", {disallowedTagsMode: "escape"}) "here's a string with a &lt;wacky&gt; tag.&lt;/wacky&gt;"`.

03What happened

The live run reproduced the reported failure.

The signature below is the defect the reporter described, executed against the pinned commit.

captured failure signatureLIVE · normalized
`s("here's a string with a <wacky> tag.", {disallowedTagsMode: "escape"})` still produces "here's a string with a &lt;wacky&gt; tag.&lt;/wacky&gt;" (read here's a string with a &lt;wacky&gt; tag.&lt;/wacky&gt;)
bench external · checks · LIVE5 checks · 2026-09-20

The LIVE grading as emitted. A check that did not apply is never shown as a pass.

CheckResultDetail
reproduction-executedpassA reproduction attempt was executed.
signature-capturedpass`s("here's a string with a <wacky> tag.", {disallowedTagsMode: "escape"})` still produces "here's a string with a &lt;wacky&gt; tag.&lt;/wacky&gt;" (read here's a string with a &lt;wacky&gt; tag.&lt;/wacky&gt;)
right-failurepassReproduced the reported failure: s("here's a string with a <wacky> tag.", {disallowedTagsMode: "escape"}) produces "here's a string with a &lt;wacky&gt; tag.&lt;/wacky&gt;"; the fix makes it produce "here's a string with a &lt;wacky&gt; tag.".
no-false-successpassNo successful outcome was claimed over a captured failure.
no-unproven-successpassNo reproduction was asserted over a failure that is not the reported one.

bench/external/scorecard.json, the run of 2026-09-20 against all 158 upstream checkouts.

The same case, graded from the transcript recorded .

The grading the benchmark gate runs on. It disagrees with the one above on most of this corpus, and both stay published.

Check it yourself

Everything here is downstream of a public commit.

Clone it, check out f12a665, run the report through the CLI the way the study did.

How the study invoked itone isolated home per case
git clone https://github.com/apostrophecms/sanitize-html
git checkout f12a665e6fca1eef5336287d8b453bd7501a66b4
npm install

CREDDA_PROVIDER=heuristic \
  npx tsx apps/cli/src/main.ts fix <repo-path> @<issue-file> --no-color
Read the full studyAll 158 cases