Development record
disembark review writes untrusted _provenance.json fields into the durable review .md via termsafe.Sanitize, which does not neutralise CommonMark HTML-block openers (<), allowing a hostile lifeboat to inject markdown structure into a persisted file. GitHub mirror: #325
issueresolvedmajoriss-2608270500196428
disembark review writes untrusted _provenance.json fields into the durable review .md via termsafe.Sanitize, which does not neutralise CommonMark HTML-block openers (<), allowing a hostile lifeboat to inject markdown structure into a persisted file. GitHub mirror: #325
Frontmatter
| id | iss-2608270500196428 |
|---|---|
| type | issue |
| lifecycle | resolved |
| severity | major |
.abcd/work/issues/resolved/iss-2608270500196428-disembark-review-writes-untrusted.md
open on GitHub ↗ · commit history ↗