ZacharyZhang-NYandClaude Opus 5.5
c5cb153f72
A document can forge both a console message and its source (KaTeX's \errmessage, data: scripts, sourceURL, encoded paths), so the display handler logs a line number and nothing the page wrote. The page's own diagnostics reach the app over elyQuery: a missed reveal sends its line; the visual failure and diagram lines already did. A test calls the real handler and checks the captured log. Round 5 found only the missing test; it is added and mutation-checked, with no sixth review under the five-round cap. M-15 is new: the print page runs a document's scripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1.1 KiB
1.1 KiB
FAIL
- crates/ely-web-content/src/handlers.rs:455 — The
ely:prefix does not establish that a message came from application code. Open Markdown containing$\errmessage{ely: M11_PRIVATE_DOCUMENT_SENTINEL}$in visual or preview mode: the bundled KaTeX executesconsole.errorwith the formula's argument verbatim, andconsole_linepreserves it asweb: page says ely: M11_PRIVATE_DOCUMENT_SENTINEL .... This writes document contents to the application log, violating PRD §18.2 and agents.md rule 4. Reproduced with the freshly built ElyMark page; probes using the unchanged Rust helper fail on both Windows and WSL while the existing unit test passes. Evidence:.work/m11-r1/page-console.log,.work/m11-r1/privacy-probe.log,.work/m11-r1/linux-privacy-probe.log. Fix direction: do not trust a text prefix to authorize arbitrary console contents; withhold third-party messages and preserve application diagnostics through controlled messages that cannot contain document text. Add a regression covering KaTeX's\errmessagewith this prefix, and update agents.md's claim accordingly.