Separate short metadata sanitization from a Markdown-aware content policy.
Keep code faithful, expose render-hidden constructs, and prevent sanitized
read-modify-write cycles from silently deleting issue and pull request data.

Refs #2202
Refs #3165

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 69c5ab30-9815-4c07-8385-11a206e68f66

Cover direct release and blame reads, reject visually blank labels and
selector channels, preserve repository fence aliases, and keep URL query
syntax out of GitHub math neutralization.

Refs #2202
Refs #3165

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 69c5ab30-9815-4c07-8385-11a206e68f66

Keep fallback entity escaping outside Markdown code, restrict bare URL
masking to supported schemes, and honor Unicode and mailto boundaries.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 69c5ab30-9815-4c07-8385-11a206e68f66

Use parsed link and autolink destinations for math masking so adjacent
content remains visible and malformed link candidates stay linear.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 69c5ab30-9815-4c07-8385-11a206e68f66

Replace heuristic URL masking with a code-aware forward scan that preserves
functional links while exposing adjacent hidden math in linear time.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 69c5ab30-9815-4c07-8385-11a206e68f66

Parse reference-link definition destinations with their own grammar
instead of reusing the inline-destination parser, which requires a
closing ')' that reference definitions never have. This kept
destinations like `[query]: /api/$filter$` from being masked, so
math neutralization corrupted them.

Validate bareHTTPURLSpan matches for a real host via
linkDestinationIsSafe before masking them, so hostless/malformed
candidates like `http://?$hidden$` stay available to math
neutralization instead of being hidden by an unconditional mask.

Add targeted unit tests, a read-modify-write round-trip test through
the GitHub tool converters, and fuzz/benchmark corpus entries
exercising large adversarial reference-destination and bare-URL
inputs to confirm linear-time behavior.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 69c5ab30-9815-4c07-8385-11a206e68f66

…ation

Bound the forward scans in inlineDestinationSpan, referenceLinkDestinationSpan,
and angleAutoLinkSpan to maxLinkDestinationLength so malformed/unterminated
candidates fail fast instead of scanning to end-of-input on every call.
Also reject a reference-link bare destination when parenthesis depth is
nonzero at termination, so unbalanced destinations are left for hidden-content
neutralization rather than incorrectly masked.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 69c5ab30-9815-4c07-8385-11a206e68f66

Restrict angle masking to supported CommonMark autolinks, reject inline destinations crossing blank paragraphs, and parse reference labels with bounded line-local grammar. Preserve valid links while keeping malformed content available for neutralization.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 69c5ab30-9815-4c07-8385-11a206e68f66