Repository navigation
§3 Seam B: react_markup XSS href + element tree dedup (SECURITY) - #5115
Merged
Merged
Conversation
…use validate_href react_markup re-minted a DIVERGING href allowlist (is_allowed_url_scheme rejected HTTPS:// that validate_href accepts) and forked the consumer element tree (ReactAttr==HtmlAttr, ReactMarkupNode==HtmlNode). Collapse to ONE authority in std.markup: MarkupNode/MarkupAttr + the validate_href/find_first_rejected_url XSS gate + the Fragment adapter. html_markup and react_markup are now thin result-type wrappers (HtmlSerializeResult / MarkupEmitResult) over the shared surface; markdown.dag reuses validate_href from std.markup (was a peer-import of std.html_markup). Consumers (gunbhub_serve, smoke, witnesses) repointed. Verified by execution: react/html/markdown XSS + gunbhub serve witnesses green; full claim_batch floor pass (221 witnesses) + dsl whole-tree compile-clean green. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Auto-opened by session-dashboard for session
fierce-raven-483.Pushing to
session/fierce-raven-483advances this PR.Worker attestation
Before flipping this PR to ready for review, confirm each item:
npm test,cargo test) and the result.Closes #Ndirective.Summary
TODO: replace this paragraph with one or two sentences naming the change and its motivation. Reviewers read this first.
Test plan