[theinfosecguy]

Decode remote config files as UTF-8, matching the local loader. Fixes corrupted Unicode names and paths, including paths that silently skip source files or fail to exclude them.

Verified with 1,230 tests and CodeQL 2.20.7/2.27.4 runs; the Unicode-path repro restores code-injection findings from 1 to 4.

Raw Latin-1 bytes now produce UTF-8 replacement characters, as they already do for local files.

[Copilot]

🟢 Approval recommended

There are no active review issues for the change to decode remote CodeQL configurations as UTF-8.

No open issues 🎉

What changed in this PR

This PR aligns remote CodeQL configuration loading with the local loader by decoding files as UTF-8, preserving Unicode names and path filters.

Changes:

• Replaces binary decoding with UTF-8 decoding for remote configuration files.
• Adds regression tests for ASCII, Unicode, emoji, and escaped YAML values with configuration validation enabled and disabled.
• Documents the fix and updates the generated JavaScript bundle.

File	Description
unreleased-change-notes/​fix-remote-config-utf8.md	Documents the remote configuration decoding fix.
src/​config/​file.ts	Decodes remote configuration content as UTF-8.
src/​config/​file.test.ts	Tests preservation of configuration names and path filters.
lib/​entry-points.js	Generated bundle reflecting the TypeScript change.

_{Review effort: Balanced (auto)}