Fix intro podcast permissions, streaming, and RSS boundaries

Bound RSS network operations, reject external XML resources in Java, preserve namespaced metadata and .NET streaming, and support SDK permission payloads without blocking Rust runtime shutdown. Add cross-language regressions and preserve the offline Java test workflow.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Author: jamesmontemagno

scripts/validate_workshop.py

@@ -1911,6 +1911,9 @@ def validate_intro_workshop() -> None:
                     f"{language} hello world must follow the source guide's four edits")
             require(re.findall(r"^### (\d+)\.", podcast_act, re.MULTILINE) == ["1", "2", "3"],
                     f"{language} podcast act must follow the source guide's three edits")
+            if language == "dotnet":
+                require("Streaming = true" in podcast_act,
+                        ".NET podcast configuration must preserve streaming for its delta event handler")
             require("Replace" in hello_act and INTRO_ENTRYPOINTS[language].replace("/", "\\") in read(guide),
                     f"{language} demo must edit its included entrypoint")
             require("LIVE_DEMO.md" in read(starter / "README.md"),

start-intro/README.md

@@ -50,4 +50,9 @@ one subscription instead of printing each text fragment twice. Node.js lets
 the bounded send propagate session errors instead of throwing from a callback.
 Its RSS helper uses parser-based XML decoding and HTML-to-plain-text extraction,
 with regression tests for CDATA, entity decoding, and script/style exclusion.
+All six RSS helpers use finite ten-second network timeouts. Java rejects XML
+DOCTYPE declarations and external resources while reading namespaced duration
+metadata. Python and Rust recognize the SDK's custom-tool permission payloads;
+Rust reads approvals on a detached input thread so a turn timeout can still
+shut down the runtime.
 The upstream repository is attribution, not a setup requirement.

start-intro/dotnet/LIVE_DEMO.md

@@ -133,6 +133,7 @@ Replace the hello-world `SessionConfig` fields with these, keeping
 
 ```csharp
 Model = model,
+Streaming = true,
 Tools = [episodeTool, latestEpisodesTool],
 AvailableTools = ["get_github_podcast_episode", "get_latest_github_podcast_episodes"],
 OnPermissionRequest = PermissionPrompt.RequestAsync,

start-intro/dotnet/Tools/GitHubPodcastEpisodeTool.cs

@@ -56,7 +56,7 @@ private static async Task<EpisodeBrief> GetAsync(string? episodeTitle)
 
     private static async Task<List<XElement>> GetItemsAsync()
     {
-        using var httpClient = new HttpClient();
+        using var httpClient = new HttpClient { Timeout = TimeSpan.FromSeconds(10) };
         var feed = await httpClient.GetStringAsync(FeedUrl);
         var document = XDocument.Parse(feed);
         return document.Descendants("item").ToList();

start-intro/go/helpers.go

@@ -12,12 +12,15 @@ import (
 	"strconv"
 	"strings"
 	"sync/atomic"
+	"time"
 
 	copilot "github.com/github/copilot-sdk/go"
 )
 
 const feedURL = "https://feeds.simplecast.com/ioCY0vfY"
 
+var podcastHTTPClient = &http.Client{Timeout: 10 * time.Second}
+
 type episodeBrief struct {
 	EpisodeNumber *int   `json:"episodeNumber"`
 	Title         string `json:"title"`
@@ -99,7 +102,7 @@ func getEpisode(episodeTitle string) (episodeBrief, error) {
 }
 
 func getItems() ([]rssItem, error) {
-	response, err := http.Get(feedURL)
+	response, err := podcastHTTPClient.Get(feedURL)
 	if err != nil {
 		return nil, err
 	}

start-intro/go/helpers_test.go

@@ -0,0 +1,65 @@
+package main
+
+import (
+	"errors"
+	"net"
+	"net/http"
+	"net/http/httptest"
+	"net/url"
+	"testing"
+	"time"
+)
+
+type feedTransport struct {
+	target *url.URL
+}
+
+func (transport feedTransport) RoundTrip(request *http.Request) (*http.Response, error) {
+	redirected := request.Clone(request.Context())
+	redirected.URL = transport.target
+	return http.DefaultTransport.RoundTrip(redirected)
+}
+
+func TestPodcastFeedDeadline(t *testing.T) {
+	if podcastHTTPClient.Timeout != 10*time.Second {
+		t.Fatalf("RSS timeout must be ten seconds, got %v", podcastHTTPClient.Timeout)
+	}
+	original := podcastHTTPClient
+	t.Cleanup(func() { podcastHTTPClient = original })
+	for _, sendHeaders := range []bool{false, true} {
+		name := "stalled headers"
+		if sendHeaders {
+			name = "stalled body"
+		}
+		t.Run(name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(func(writer http.ResponseWriter, request *http.Request) {
+				if sendHeaders {
+					writer.WriteHeader(http.StatusOK)
+					writer.(http.Flusher).Flush()
+				}
+				select {
+				case <-request.Context().Done():
+				case <-time.After(2 * time.Second):
+				}
+			}))
+			defer server.Close()
+			target, err := url.Parse(server.URL)
+			if err != nil {
+				t.Fatal(err)
+			}
+			client := *original
+			client.Timeout = 100 * time.Millisecond
+			client.Transport = feedTransport{target: target}
+			podcastHTTPClient = &client
+			start := time.Now()
+			_, err = getItems()
+			var timeout net.Error
+			if !errors.As(err, &timeout) || !timeout.Timeout() {
+				t.Fatalf("Expected a timeout, got %v", err)
+			}
+			if elapsed := time.Since(start); elapsed > time.Second {
+				t.Fatalf("RSS request exceeded its deadline: %v", elapsed)
+			}
+		})
+	}
+}

start-intro/java/pom.xml

@@ -9,8 +9,22 @@
   <properties>
     <maven.compiler.release>17</maven.compiler.release>
     <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+    <maven.surefire.version>3.2.5</maven.surefire.version>
   </properties>
   <dependencies>
+    <dependency>
+      <groupId>junit</groupId>
+      <artifactId>junit</artifactId>
+      <version>4.13.2</version>
+      <scope>test</scope>
+    </dependency>
+    <!-- Restore the dynamically selected test provider before CI's offline test run. -->
+    <dependency>
+      <groupId>org.apache.maven.surefire</groupId>
+      <artifactId>surefire-junit4</artifactId>
+      <version>${maven.surefire.version}</version>
+      <scope>test</scope>
+    </dependency>
     <dependency>
       <groupId>com.github</groupId>
       <artifactId>copilot-sdk-java</artifactId>
@@ -19,6 +33,11 @@
   </dependencies>
   <build>
     <plugins>
+      <plugin>
+        <groupId>org.apache.maven.plugins</groupId>
+        <artifactId>maven-surefire-plugin</artifactId>
+        <version>${maven.surefire.version}</version>
+      </plugin>
       <plugin>
         <groupId>org.apache.maven.plugins</groupId>
         <artifactId>maven-compiler-plugin</artifactId>

start-intro/java/src/main/java/demo/GitHubPodcastEpisodeTool.java

@@ -4,15 +4,24 @@
 import com.github.copilot.tool.Param;
 
 import javax.xml.parsers.DocumentBuilderFactory;
+import javax.xml.XMLConstants;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
 import java.net.URI;
 import java.net.http.HttpClient;
 import java.net.http.HttpRequest;
 import java.net.http.HttpResponse;
+import java.time.Duration;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.concurrent.TimeUnit;
+import java.util.concurrent.TimeoutException;
 
 public final class GitHubPodcastEpisodeTool {
     private static final String FEED_URL = "https://feeds.simplecast.com/ioCY0vfY";
+    private static final Duration FEED_TIMEOUT = Duration.ofSeconds(10);
+    private static final HttpClient FEED_CLIENT = HttpClient.newBuilder()
+            .connectTimeout(FEED_TIMEOUT).build();
 
     private GitHubPodcastEpisodeTool() {
     }
@@ -76,10 +85,41 @@ private static String getEpisodeJson(String episodeTitle) {
     }
 
     private static List<org.w3c.dom.Element> items() throws Exception {
-        var response = HttpClient.newHttpClient().send(
-                HttpRequest.newBuilder(URI.create(FEED_URL)).build(),
-                HttpResponse.BodyHandlers.ofInputStream());
-        var document = DocumentBuilderFactory.newInstance().newDocumentBuilder().parse(response.body());
+        return readItems(FEED_CLIENT, URI.create(FEED_URL), FEED_TIMEOUT);
+    }
+
+    static List<org.w3c.dom.Element> readItems(HttpClient client, URI uri, Duration timeout) throws Exception {
+        var request = HttpRequest.newBuilder(uri).timeout(timeout).build();
+        var pending = client.sendAsync(request, HttpResponse.BodyHandlers.ofByteArray());
+        HttpResponse<byte[]> response;
+        try {
+            response = pending.get(timeout.toMillis(), TimeUnit.MILLISECONDS);
+        } catch (TimeoutException exception) {
+            throw new IOException("The GitHub Podcast RSS request timed out.", exception);
+        } catch (InterruptedException exception) {
+            Thread.currentThread().interrupt();
+            throw exception;
+        } finally {
+            pending.cancel(true);
+        }
+        if (response.statusCode() < 200 || response.statusCode() >= 300) {
+            throw new IOException("Failed to fetch The GitHub Podcast RSS feed: " + response.statusCode());
+        }
+        return parseItems(response.body());
+    }
+
+    static List<org.w3c.dom.Element> parseItems(byte[] xml) throws Exception {
+        var factory = DocumentBuilderFactory.newInstance();
+        factory.setNamespaceAware(true);
+        factory.setFeature(XMLConstants.FEATURE_SECURE_PROCESSING, true);
+        factory.setFeature("http://apache.org/xml/features/disallow-doctype-decl", true);
+        factory.setFeature("http://xml.org/sax/features/external-general-entities", false);
+        factory.setFeature("http://xml.org/sax/features/external-parameter-entities", false);
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_DTD, "");
+        factory.setAttribute(XMLConstants.ACCESS_EXTERNAL_SCHEMA, "");
+        factory.setXIncludeAware(false);
+        factory.setExpandEntityReferences(false);
+        var document = factory.newDocumentBuilder().parse(new ByteArrayInputStream(xml));
         var nodes = document.getElementsByTagName("item");
         var items = new ArrayList<org.w3c.dom.Element>();
         for (int index = 0; index < nodes.getLength(); index++) {
@@ -88,7 +128,7 @@ private static List<org.w3c.dom.Element> items() throws Exception {
         return items;
     }
 
-    private static EpisodeBrief toEpisodeBrief(org.w3c.dom.Element item) {
+    static EpisodeBrief toEpisodeBrief(org.w3c.dom.Element item) {
         var title = value(item, "title");
         return new EpisodeBrief(
                 episodeNumber(title),

start-intro/java/src/test/java/demo/GitHubPodcastEpisodeToolTest.java

@@ -0,0 +1,96 @@
+package demo;
+
+import com.sun.net.httpserver.HttpServer;
+import org.junit.Test;
+import org.xml.sax.SAXParseException;
+
+import java.io.IOException;
+import java.net.InetSocketAddress;
+import java.net.URI;
+import java.net.http.HttpClient;
+import java.net.http.HttpTimeoutException;
+import java.nio.charset.StandardCharsets;
+import java.time.Duration;
+import java.util.concurrent.CountDownLatch;
+import java.util.concurrent.TimeUnit;
+
+import static org.junit.Assert.*;
+
+public class GitHubPodcastEpisodeToolTest {
+    private static final String RSS = """
+            <rss xmlns:itunes="http://www.itunes.com/dtds/podcast-1.0.dtd"><channel><item>
+            <title>42: GitHub &amp; Copilot</title>
+            <itunes:duration>00:30:00</itunes:duration>
+            <description><![CDATA[<p>Grounded facts</p>]]></description>
+            </item></channel></rss>
+            """;
+
+    @Test
+    public void readsNamespacedDuration() throws Exception {
+        var items = GitHubPodcastEpisodeTool.parseItems(RSS.getBytes(StandardCharsets.UTF_8));
+        var episode = GitHubPodcastEpisodeTool.toEpisodeBrief(items.get(0));
+        assertEquals(Integer.valueOf(42), episode.episodeNumber());
+        assertEquals("42: GitHub & Copilot", episode.title());
+        assertEquals("00:30:00", episode.duration());
+        assertEquals("Grounded facts", episode.description());
+    }
+
+    @Test
+    public void rejectsInternalAndExternalDoctypes() {
+        for (var declaration : new String[]{
+                "<!DOCTYPE rss [<!ENTITY unsafe 'expanded content'>]>",
+                "<!DOCTYPE rss [<!ENTITY unsafe SYSTEM 'file:///must-not-be-read'>]>",
+                "<!DOCTYPE rss SYSTEM 'https://example.invalid/must-not-be-requested'>"
+        }) {
+            var xml = declaration + "<rss><channel><item><title>&unsafe;</title></item></channel></rss>";
+            assertThrows(SAXParseException.class,
+                    () -> GitHubPodcastEpisodeTool.parseItems(xml.getBytes(StandardCharsets.UTF_8)));
+        }
+    }
+
+    @Test(timeout = 10000)
+    public void boundsBothHeadersAndBodyReads() throws Exception {
+        for (var sendHeaders : new boolean[]{false, true}) {
+            var release = new CountDownLatch(1);
+            var headersSent = new CountDownLatch(1);
+            var server = HttpServer.create(new InetSocketAddress("127.0.0.1", 0), 0);
+            server.createContext("/", exchange -> {
+                try {
+                    if (sendHeaders) {
+                        exchange.sendResponseHeaders(200, 0);
+                        exchange.getResponseBody().flush();
+                        headersSent.countDown();
+                    }
+                    release.await(2, TimeUnit.SECONDS);
+                    if (!sendHeaders) {
+                        exchange.sendResponseHeaders(200, 0);
+                    }
+                    exchange.getResponseBody().write(RSS.getBytes(StandardCharsets.UTF_8));
+                } catch (InterruptedException exception) {
+                    Thread.currentThread().interrupt();
+                    throw new IOException(exception);
+                } finally {
+                    exchange.close();
+                }
+            });
+            server.start();
+            try {
+                var uri = URI.create("http://127.0.0.1:" + server.getAddress().getPort() + "/");
+                var start = System.nanoTime();
+                var failure = assertThrows(Exception.class, () -> GitHubPodcastEpisodeTool.readItems(
+                        HttpClient.newHttpClient(), uri, Duration.ofMillis(300)));
+                assertTrue("Expected a request deadline failure",
+                        failure instanceof IOException && failure.getMessage().contains("timed out")
+                                || failure.getCause() instanceof HttpTimeoutException);
+                assertTrue("The full RSS body must be deadline-bounded",
+                        System.nanoTime() - start < TimeUnit.MILLISECONDS.toNanos(1500));
+                if (sendHeaders) {
+                    assertEquals("The body-stall fixture must send headers", 0, headersSent.getCount());
+                }
+            } finally {
+                release.countDown();
+                server.stop(0);
+            }
+        }
+    }
+}

start-intro/nodejs/src/github-podcast-tools.ts

@@ -61,7 +61,7 @@ export async function pickEpisode(episodes: EpisodeBrief[]): Promise<EpisodeBrie
 }
 
 async function getItems(): Promise<string[]> {
-  const response = await fetch(feedUrl);
+  const response = await fetch(feedUrl, { signal: AbortSignal.timeout(10_000) });
   if (!response.ok) {
     throw new Error(`Failed to fetch The GitHub Podcast RSS feed: ${response.status}`);
   }