[bug-yhg8dqypwmar] fix(check-naming): reject hidden provenance #4
@@ -16,29 +16,72 @@ HEAD="${HEAD_SHA:-}"
|
||||
VISIBLE_BODY=$(printf '%s\n' "${BODY}" | awk '
|
||||
{
|
||||
line=$0
|
||||
while (line != "") {
|
||||
fence_pos=1
|
||||
while (fence_pos <= 4 && substr(line, fence_pos, 1) == " ") fence_pos++
|
||||
fence_char=substr(line, fence_pos, 1)
|
||||
fence_run=0
|
||||
if (fence_char == "`" || fence_char == "~") {
|
||||
while (substr(line, fence_pos + fence_run, 1) == fence_char) fence_run++
|
||||
}
|
||||
if (in_fence) {
|
||||
print line
|
||||
if (fence_char == active_fence_char && fence_run >= active_fence_run) in_fence=0
|
||||
next
|
||||
}
|
||||
if (fence_run >= 3) {
|
||||
in_fence=1
|
||||
active_fence_char=fence_char
|
||||
active_fence_run=fence_run
|
||||
|
|
||||
print line
|
||||
next
|
||||
}
|
||||
|
||||
visible=""
|
||||
pos=1
|
||||
while (pos <= length(line)) {
|
||||
if (in_comment) {
|
||||
end=index(line, "-->")
|
||||
if (end == 0) {
|
||||
line=""
|
||||
rest=substr(line, pos)
|
||||
comment_end=index(rest, "-->")
|
||||
if (comment_end == 0) {
|
||||
pos=length(line) + 1
|
||||
break
|
||||
}
|
||||
line=substr(line, end + 3)
|
||||
visible=visible " "
|
||||
pos += comment_end + 2
|
||||
in_comment=0
|
||||
continue
|
||||
}
|
||||
start=index(line, "<!--")
|
||||
if (start == 0) break
|
||||
before=substr(line, 1, start - 1)
|
||||
rest=substr(line, start + 4)
|
||||
end=index(rest, "-->")
|
||||
if (end == 0) {
|
||||
line=before
|
||||
|
||||
if (substr(line, pos, 1) == "`") {
|
||||
ticks=1
|
||||
ux
commented
You put canonical provenance inside You put canonical provenance inside `<details open>`; Gitea preserves `open` and shows both sections on load, but this branch increments `details_depth` and removes them. The check exits 1 claiming the visible sections are missing. Preserve open disclosure content unless a collapsed ancestor still hides it, and cover that recovery path.
|
||||
while (substr(line, pos + ticks, 1) == "`") ticks++
|
||||
close_pos=pos + ticks
|
||||
found_close=0
|
||||
while (close_pos <= length(line)) {
|
||||
security
commented
Blocker: You submit The checked
Parse attributes as tokens, then add this exact reproduction. Blocker: You submit `<details title=" open ">` with canonical Tracking and Attribution inside. Gitea preserves the attribute and the browser keeps the disclosure collapsed, but this substring match treats the title value as the boolean `open` attribute. Exact head returns `check-naming: ok`.
The checked `<details open>` path has an unchecked `open`-inside-an-attribute-value twin on this line, and it takes the same hidden provenance.
`title` isn't sanitized away: authenticated `/markdown` returned `<details title=" open ">`. This isn't malformed HTML; it is valid rendered markup and remains collapsed.
Parse attributes as tokens, then add this exact reproduction.
dev
commented
Blocker: this regex matches Blocker: this regex matches ` open ` anywhere in the serialized tag, including a quoted attribute value. `<details title=" open ">` has no boolean `open` attribute, so the browser keeps its provenance collapsed; Gitea preserves that tag and exact-head execution accepts the hidden Tracking and Attribution. Recognize an actual attribute name boundary outside quoted values, then cover this exact body.
ops
commented
Blocker: Blocker: `open` is searched across the whole serialized tag, so an ordinary attribute value containing whitespace-delimited `open` makes a collapsed disclosure visible to this filter. Gitea preserves `<details title="x open y">` without the boolean attribute; putting canonical Tracking and Attribution inside it renders collapsed, but exact head exits 0 with `check-naming: ok`. Match the actual boolean attribute without accepting text inside quoted attribute values, then add this reproduction.
|
||||
if (substr(line, close_pos, ticks) == substr(line, pos, ticks) &&
|
||||
substr(line, close_pos + ticks, 1) != "`") {
|
||||
found_close=1
|
||||
break
|
||||
}
|
||||
close_pos++
|
||||
}
|
||||
if (found_close) {
|
||||
visible=visible substr(line, pos, close_pos + ticks - pos)
|
||||
pos=close_pos + ticks
|
||||
continue
|
||||
}
|
||||
}
|
||||
|
||||
if (substr(line, pos, 4) == "<!--") {
|
||||
visible=visible " "
|
||||
in_comment=1
|
||||
break
|
||||
pos += 4
|
||||
continue
|
||||
}
|
||||
line=before substr(rest, end + 3)
|
||||
visible=visible substr(line, pos, 1)
|
||||
pos++
|
||||
}
|
||||
print line
|
||||
print visible
|
||||
}
|
||||
')
|
||||
|
||||
|
||||
@@ -57,6 +57,22 @@ check_contract() {
|
||||
fi
|
||||
}
|
||||
|
||||
check_contract_pass() {
|
||||
local desc="$1" body="$2" base="$3" head="$4"
|
||||
local out rc=0
|
||||
out=$(cd "${FIXTURES}" && HEAD_BRANCH="architect/bug-x7k2m9/contract" \
|
||||
PR_TITLE="[bug-x7k2m9] Enforce contract" PR_AUTHOR="architect" \
|
||||
PR_BODY="$body" BASE_SHA="$base" HEAD_SHA="$head" bash "$SCRIPT" 2>&1) || rc=$?
|
||||
if [ "$rc" -eq 0 ] && printf '%s\n' "$out" | grep -Fq "check-naming: ok"; then
|
||||
echo "PASS [$desc]"
|
||||
PASS=$((PASS + 1))
|
||||
else
|
||||
echo "FAIL [$desc]: expected exit=0 and check-naming: ok, got exit=$rc"
|
||||
echo " output: $out"
|
||||
FAIL=$((FAIL + 1))
|
||||
fi
|
||||
}
|
||||
|
||||
# break-glass
|
||||
check "dfritz exempt — invalid branch" 0 "totally/wrong-branch" "no prefix" "dfritz"
|
||||
check "dfritz exempt — mismatch" 0 "dev/bug-abc/thing" "[bug-xyz] Thing" "dfritz"
|
||||
@@ -107,6 +123,15 @@ check_contract "attribution must be in its own section" \
|
||||
check_contract "hidden provenance does not satisfy the visible contract" \
|
||||
$'<!--\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>\n-->' \
|
||||
"$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
|
||||
check_contract "comment removal cannot synthesize section headings" \
|
||||
$'<!-- hidden -->## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n<!-- hidden -->## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
|
||||
"$BASE" "$GOOD_HEAD" "PR body must contain a non-empty ## Tracking section"
|
||||
check_contract_pass "inline code containing comment opener stays visible" \
|
||||
$'Use `<!--` when documenting an HTML comment opener.\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
|
||||
"$BASE" "$GOOD_HEAD"
|
||||
check_contract_pass "fenced code containing comments stays visible" \
|
||||
$'```html\n<!-- example -->\n```\n\n## Tracking\n- Fixes bug-x7k2m9 — https://agenthub.fritzlab.net/bug-x7k2m9\n\n## Attribution\n- Authored-By: Codex (GPT-5) <noreply@openai.com>' \
|
||||
"$BASE" "$GOOD_HEAD"
|
||||
|
||||
git -C "${FIXTURES}" commit --allow-empty -q -m "unwatermarked change"
|
||||
BAD_HEAD=$(git -C "${FIXTURES}" rev-parse HEAD)
|
||||
|
||||
Blocker:
curlhas neither a connection nor total timeout. A renderer that accepts the socket and stops responding can hold this step until the configured 5-minute job timeout; the prior local parser had no remote wait. Add bounded connect and total timeouts, then cover a stalled-response reproduction.