ElyOffice/tasks/reviews/C14.14-r2.md

FAIL

• apps/ely-mark/src/output/html.rs:270 — Scheme detection treats whitespace in a scheme as absence of a scheme, which safe allows. [run](< javascript:alert(1)>) exports a live JavaScript link; java	script: and java
script: also bypass the filter because browsers remove those controls. The probes produce these hrefs without diagnostics, and URL normalization identifies all three as javascript:. Validate the browser-normalized address against the allowed schemes, rejecting executable and other disallowed schemes even when obfuscated. Evidence: .work/C14.14-r2/windows-probe.log, linux-probe.log, linux-url-probe.log.

• apps/ely-mark/src/output/files.rs:71 — Cleanup infers folder ownership from an earlier exists() check rather than successful creation. Start a linked export with many paragraphs before its first image, then export a short document to the same destination while the first is parsing. Both initially see no resource folder; the short export succeeds, but the first later gets AlreadyExists and deletes the successful export's folder. Native Windows and WSL both reproduce folder_before_loser=true, then folder_after_loser=false with the HTML still present. Track which operation actually created the resource folder and only let that operation clean it up. Evidence: .work/C14.14-r2/windows-probe.log, linux-probe.log.

• reference/Ely-GPUI-Components/src/typography/math.rs:120 (ff9c0f8) — formula_svg assumes RaTeX's embed_glyphs guarantees outlines, but RaTeX silently falls back to SVG text for unsupported glyphs. Exporting Before $\text{𓀀}$ after. succeeds with no formula diagnostic while the rendered PDF contains a missing-glyph box instead of the formula character. The returned SVG contains a KaTeX_Main text element rather than that glyph's outline. Convert remaining text to outlines with checked glyph coverage, or return MathError so ElyMark preserves the TeX and reports its line. Cover this fallback in export tests. Evidence: .work/C14.14-r2/linux-formula.log, linux-formula-output.log, raster-verification.log.