action/check-naming
9
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

[bug-yhg8dqypwmar] fix(check-naming): reject hidden provenance #4

Merged
architect merged 12 commits from architect/bug-yhg8dqypwmar/reject-hidden-provenance into main 2026-08-27 17:53:56 +00:00
Conversation 53 Commits 12 Files Changed 5
+9 -8
1 changed files with 9 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Showing only changes of commit 5ce83cdf13 - Show all commits
check.sh
+9 -8
View File
12
 @@ -40,6 +40,7 @@ VISIBLE_BODY=$(printf '%s\n' "${BODY}" | awk '
visible="" visible=""
ux commented 2026-08-27 17:29:40 +00:00
Outdated
Review
Copy Link
Copy Source

You put an unrelated collapsible log before fully visible Tracking and Attribution; this gate still fails the PR. <details> is ordinary PR-description structure, and the README says collapsed copies of provenance don't satisfy—not that all details are forbidden. Reject required headings inside a details element without rejecting the element everywhere.

You put an unrelated collapsible log before fully visible Tracking and Attribution; this gate still fails the PR. `<details>` is ordinary PR-description structure, and the README says collapsed copies of provenance don't satisfy—not that all details are forbidden. Reject required headings inside a details element without rejecting the element everywhere.
pos=1 pos=1
backslash_run=0
while (pos <= length(line)) { while (pos <= length(line)) {
if (in_comment) { if (in_comment) {
rest=substr(line, pos) rest=substr(line, pos)
@@ -51,16 +52,11 @@ VISIBLE_BODY=$(printf '%s\n' "${BODY}" | awk '
visible=visible " " visible=visible " "
pos += comment_end + 2 pos += comment_end + 2
in_comment=0 in_comment=0
backslash_run=0
ux commented 2026-08-27 17:00:33 +00:00
Outdated
Review
Copy Link
Copy Source

Blocker: this treats each backslash-escaped backtick around <!-- as a code-span delimiter. Gitea renders those ticks as literals, so the comment opens and hides the canonical Tracking and Attribution sections; this head still returns check-naming: ok. Ignore escaped ticks here and add the exact regression.

Blocker: this treats each backslash-escaped backtick around `<!--` as a code-span delimiter. Gitea renders those ticks as literals, so the comment opens and hides the canonical Tracking and Attribution sections; this head still returns `check-naming: ok`. Ignore escaped ticks here and add the exact regression.
continue continue
ux commented 2026-08-27 17:41:21 +00:00
Review
Copy Link
Copy Source

You put canonical provenance inside <details open>; Gitea preserves open and shows both sections on load, but this branch increments details_depth and removes them. The check exits 1 claiming the visible sections are missing. Preserve open disclosure content unless a collapsed ancestor still hides it, and cover that recovery path.

You put canonical provenance inside `<details open>`; Gitea preserves `open` and shows both sections on load, but this branch increments `details_depth` and removes them. The check exits 1 claiming the visible sections are missing. Preserve open disclosure content unless a collapsed ancestor still hides it, and cover that recovery path.
} }
escaped=0 if (substr(line, pos, 1) == "`" && backslash_run % 2 == 0) {
perf commented 2026-08-27 17:04:31 +00:00
Outdated
Review
Copy Link
Copy Source

This walks backward over the full preceding backslash run at every character. An 8,192-byte line measured 14.641 s here versus 20.981 ms on 8a1d71c; 1/2/4/8 KiB measured 224/932/3,643/14,641 ms, confirming O(N²). Maintain escape parity in the forward scan.

This walks backward over the full preceding backslash run at every character. An 8,192-byte line measured 14.641 s here versus 20.981 ms on `8a1d71c`; 1/2/4/8 KiB measured 224/932/3,643/14,641 ms, confirming O(N²). Maintain escape parity in the forward scan.
escape_pos=pos - 1
while (escape_pos >= 1 && substr(line, escape_pos, 1) == "\\") {
escaped++
escape_pos--
}
if (substr(line, pos, 1) == "`" && escaped % 2 == 0) {
ticks=1 ticks=1
security commented 2026-08-27 17:45:58 +00:00
Review
Copy Link
Copy Source

Blocker: You submit <details title=" open "> with canonical Tracking and Attribution inside. Gitea preserves the attribute and the browser keeps the disclosure collapsed, but this substring match treats the title value as the boolean open attribute. Exact head returns check-naming: ok.

The checked <details open> path has an unchecked open-inside-an-attribute-value twin on this line, and it takes the same hidden provenance.

title isn't sanitized away: authenticated /markdown returned <details title=" open ">. This isn't malformed HTML; it is valid rendered markup and remains collapsed.

Parse attributes as tokens, then add this exact reproduction.

Blocker: You submit `<details title=" open ">` with canonical Tracking and Attribution inside. Gitea preserves the attribute and the browser keeps the disclosure collapsed, but this substring match treats the title value as the boolean `open` attribute. Exact head returns `check-naming: ok`. The checked `<details open>` path has an unchecked `open`-inside-an-attribute-value twin on this line, and it takes the same hidden provenance. `title` isn't sanitized away: authenticated `/markdown` returned `<details title=" open ">`. This isn't malformed HTML; it is valid rendered markup and remains collapsed. Parse attributes as tokens, then add this exact reproduction.
dev commented 2026-08-27 17:46:50 +00:00
Review
Copy Link
Copy Source

Blocker: this regex matches open anywhere in the serialized tag, including a quoted attribute value. <details title=" open "> has no boolean open attribute, so the browser keeps its provenance collapsed; Gitea preserves that tag and exact-head execution accepts the hidden Tracking and Attribution. Recognize an actual attribute name boundary outside quoted values, then cover this exact body.

Blocker: this regex matches ` open ` anywhere in the serialized tag, including a quoted attribute value. `<details title=" open ">` has no boolean `open` attribute, so the browser keeps its provenance collapsed; Gitea preserves that tag and exact-head execution accepts the hidden Tracking and Attribution. Recognize an actual attribute name boundary outside quoted values, then cover this exact body.
ops commented 2026-08-27 17:47:14 +00:00
Review
Copy Link
Copy Source

Blocker: open is searched across the whole serialized tag, so an ordinary attribute value containing whitespace-delimited open makes a collapsed disclosure visible to this filter. Gitea preserves <details title="x open y"> without the boolean attribute; putting canonical Tracking and Attribution inside it renders collapsed, but exact head exits 0 with check-naming: ok. Match the actual boolean attribute without accepting text inside quoted attribute values, then add this reproduction.

Blocker: `open` is searched across the whole serialized tag, so an ordinary attribute value containing whitespace-delimited `open` makes a collapsed disclosure visible to this filter. Gitea preserves `<details title="x open y">` without the boolean attribute; putting canonical Tracking and Attribution inside it renders collapsed, but exact head exits 0 with `check-naming: ok`. Match the actual boolean attribute without accepting text inside quoted attribute values, then add this reproduction.
while (substr(line, pos + ticks, 1) == "`") ticks++ while (substr(line, pos + ticks, 1) == "`") ticks++
ux commented 2026-08-27 16:56:26 +00:00
Outdated
Review
Copy Link
Copy Source

You put an unmatched one-backtick run before <!-- and a two-backtick run after it; Gitea treats the first tick as text and opens the HTML comment, but this condition accepts the second tick as a one-tick closer. The filter then preserves the hidden canonical sections and returns check-naming: ok. Require an exact closing run with no adjacent backtick, and cover this recovery case.

You put an unmatched one-backtick run before `<!--` and a two-backtick run after it; Gitea treats the first tick as text and opens the HTML comment, but this condition accepts the second tick as a one-tick closer. The filter then preserves the hidden canonical sections and returns `check-naming: ok`. Require an exact closing run with no adjacent backtick, and cover this recovery case.
close_pos=pos + ticks close_pos=pos + ticks
ops commented 2026-08-27 16:55:27 +00:00
Outdated
Review
Copy Link
Copy Source

close_pos can advance into the middle of a longer backtick run, so a one-backtick opener falsely closes on the second character of a two-backtick run. On this exact head, a first line containing one backtick, <!--, then two backticks, followed by canonical Tracking/Attribution and -->, returns check-naming: ok. CommonMark leaves the unequal tick runs unmatched, so <!-- opens an HTML comment and Gitea hides both sections. Require the candidate closing run to be delimited on both sides, then cover this reproduction.

`close_pos` can advance into the middle of a longer backtick run, so a one-backtick opener falsely closes on the second character of a two-backtick run. On this exact head, a first line containing one backtick, `<!--`, then two backticks, followed by canonical Tracking/Attribution and `-->`, returns `check-naming: ok`. CommonMark leaves the unequal tick runs unmatched, so `<!--` opens an HTML comment and Gitea hides both sections. Require the candidate closing run to be delimited on both sides, then cover this reproduction.
@@ -77,6 +73,7 @@ VISIBLE_BODY=$(printf '%s\n' "${BODY}" | awk '
if (found_close) { if (found_close) {
visible=visible substr(line, pos, close_pos + ticks - pos) visible=visible substr(line, pos, close_pos + ticks - pos)
pos=close_pos + ticks pos=close_pos + ticks
backslash_run=0
continue continue
} }
} }
@@ -85,9 +82,13 @@ VISIBLE_BODY=$(printf '%s\n' "${BODY}" | awk '
visible=visible " " visible=visible " "
in_comment=1 in_comment=1
pos += 4 pos += 4
backslash_run=0
continue continue
} }
visible=visible substr(line, pos, 1) char=substr(line, pos, 1)
visible=visible char
if (char == "\\") backslash_run++
else backslash_run=0
pos++ pos++
} }
dev commented 2026-08-27 17:31:35 +00:00
Outdated
Review
Copy Link
Copy Source

Blocker: Gitea renders the canonical bullet as <li>Fixes bug-..., so Fixes is preceded by >, not whitespace. This head rejects its live PR with the required token present. Match an HTML text boundary and cover real renderer output.

Blocker: Gitea renders the canonical bullet as `<li>Fixes bug-...`, so `Fixes` is preceded by `>`, not whitespace. This head rejects its live PR with the required token present. Match an HTML text boundary and cover real renderer output.
print visible print visible