Wow, they seem to have terrible commit message practice. The latest commit has a message of "...", and many others only have a bug number (which leads to an annoying usability issue on the github UI - I click the title to get to the commit - which now links to a GitHub issue).
[EDIT: Actually, 8 of the commits top of tree as of writing are "...". wow.]
On top of that, "Second effort to sanitize input string" at [1] appears related to this issue, and doesn't have a single test change, even on the second attempt!
edit: PoC here https://news.ycombinator.com/item?id=11624056 though I haven't ran it myself.