ZacharyZhang-NYandClaude Opus 5.5
c5cb153f72
A document can forge both a console message and its source (KaTeX's \errmessage, data: scripts, sourceURL, encoded paths), so the display handler logs a line number and nothing the page wrote. The page's own diagnostics reach the app over elyQuery: a missed reveal sends its line; the visual failure and diagram lines already did. A test calls the real handler and checks the captured log. Round 5 found only the missing test; it is added and mutation-checked, with no sixth review under the five-round cap. M-15 is new: the print page runs a document's scripts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
6 lines
2.0 KiB
Markdown
6 lines
2.0 KiB
Markdown
FAIL
|
|
|
|
- crates/ely-web-content/src/surface.rs:82 — The logged name still comes from the untrusted URL rather than the verified file. On Windows, with a real `main.js` under the page root, execute `console.warn('hidden');` with `//# sourceURL=file:///.../content/M11_PRIVATE_DOCUMENT_SENTINEL%2F..%2Fmain.js`. Windows canonicalization removes the decoded nonexistent intermediate directory followed by `..`, so `holds()` accepts the real `main.js`; `script()` returns `M11_PRIVATE_DOCUMENT_SENTINEL%2F..%2Fmain.js`. Native CEF preserves that source metadata, and the unchanged display handler logs the document marker verbatim. This violates PRD §18.2 and rule 4; it is a leak introduced by the new name extraction, independent of the pre-existing W-02 test failures. Round 3's missing-file, query, fragment and data-source cases are fixed, but the new repository test passes despite this encoded-path leak. Fix direction: derive the diagnostic name from the canonical file verified by the fence, and add a regression excluding document text carried by encoded path components. Evidence: `.work/m11-r4/windows-probe.log`, `windows-native.log`, and `evidence.log`.
|
|
|
|
- crates/ely-web-content/src/surface.rs:81 — `holds()` verifies canonical containment but does not require a file, so `script()` also trusts directories ending in `.js`. Create `content/M11_DIRECTORY_SENTINEL.js` as a directory and use its file URL as a console `sourceURL`: both Windows and WSL native CEF probes log `web: the page warned at M11_DIRECTORY_SENTINEL.js:1`, although no such script file exists. This breaks the required real-file restriction and agents.md's updated claim. The added regression omits directories and therefore passes. Fix direction: require the canonical target to be a regular file under the same root before returning its script name; test a `.js` directory explicitly. Evidence: `.work/m11-r4/windows-probe.log`, `linux-probe.log`, `windows-native.log`, and `linux-native.log`. Probe copies and their dedicated targets were deleted before this verdict.
|