ZacharyZhang-NYandClaude Opus 5.5
c5cb153f72
A document can forge both a console message and its source (KaTeX's \errmessage, data: scripts, sourceURL, encoded paths), so the display handler logs a line number and nothing the page wrote. The page's own diagnostics reach the app over elyQuery: a missed reveal sends its line; the visual failure and diagram lines already did. A test calls the real handler and checks the captured log. Round 5 found only the missing test; it is added and mutation-checked, with no sixth review under the five-round cap. M-15 is new: the print page runs a document's scripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1.3 KiB
1.3 KiB
FAIL
- crates/ely-web-content/src/handlers.rs:453 —
warned()trusts everyfile://console source as a bundled script and logs its final URL segment, including query/fragment text. JavaScript'ssourceURLcan supply this metadata without loading that file. Extend round 2's data-script Markdown fixture withconsole.warn('hidden message');\n//# sourceURL=file:///not-bundled/M11_PRIVATE_SOURCE_SENTINEL.js: the actual page renderer retains it, and the staged print page's warning becomesweb: the page warned at M11_PRIVATE_SOURCE_SENTINEL.js:1. Native CEF probes using the unchanged production display handler and resource fence reproduce this on Windows and WSL; both privacy assertions fail. A source ending inmain.js?M11_PRIVATE_QUERY_SENTINELalso leaks its query. This still violates PRD §18.2 and agents.md rule 4. The previous plaindata:source and KaTeX message cases are fixed; script execution itself is outside this finding. Fix direction: log only verified bundled script identifiers, exclude URL queries/fragments, and use the fixed inline-script diagnostic for all other sources. Add regressions for forgedfile://sources and URL suffixes; the current two-case test passes despite this leak. Evidence:.work/m11-r3/windows-cef-export.log,.work/m11-r3/linux-cef-export.log, both*-privacy-assert.log, andevidence.log.