[Bug] SECURITY.md contradicts itself and reports an advisory for a version not shipped #577

New issue

Closed

opened 2026-07-22 16:15:22 +00:00 by brenno · 1 comment

brenno commented

2026-07-22 16:15:22 +00:00

Owner

Found in the pre-publication security review.

Evidence: SECURITY.md:171-177 contains two mutually contradictory opening sentences, one directly beneath the other:

lines 171-174: "As of the last review all pins (… DOMPurify 3.4.12, mermaid 11.16.0 …) carry no known advisories. One tracked … item:"
lines 175-177: "As of 2026-07-22 one pin carries an advisory (DOMPurify 3.4.11, below); the others (… mermaid 10.9.6 …) carry none. Three tracked … items:"

Two bullets then follow, matching neither count.

What is actually shipped: assets/web_export/MANIFEST.json pins dompurify 3.4.12 and mermaid 11.16.0; shasum -a 256 assets/web_export/*.js matches the manifest; sbom/ocideck.sbom.md:223,227 names 3.4.12 and 11.16.0. The same stale figure appears in docs/SECURITY_DESIGN.md:668 ("mermaid 10.9.6 and MathJax 3.2.2").

Why this must be fixed before publication: this is the first paragraph a security reader looks up, and it reads as a half-applied edit. Worse, it declares a vulnerable DOMPurify 3.4.11 that the product does not ship — an incorrect statement to third parties, and one that makes the product look worse than it is. Anyone who spots this stops believing the rest of SECURITY.md, including the many parts that are correct.

Proposal: delete one of the two paragraphs, make the count ("one"/"three") match the number of bullets, drop the DOMPurify bullet that has already been carried out, and correct "mermaid 10.9.6" to 11.16.0 in both SECURITY.md and docs/SECURITY_DESIGN.md:668. One commit, no code change.

Found in the pre-publication security review. **Evidence:** `SECURITY.md:171-177` contains two mutually contradictory opening sentences, one directly beneath the other: - lines 171-174: "As of the last review all pins (… DOMPurify 3.4.12, mermaid 11.16.0 …) carry **no known advisories**. One tracked … item:" - lines 175-177: "As of 2026-07-22 one pin carries an advisory (DOMPurify 3.4.11, below); the others (… mermaid 10.9.6 …) carry none. Three tracked … items:" Two bullets then follow, matching neither count. **What is actually shipped:** `assets/web_export/MANIFEST.json` pins dompurify 3.4.12 and mermaid 11.16.0; `shasum -a 256 assets/web_export/*.js` matches the manifest; `sbom/ocideck.sbom.md:223,227` names 3.4.12 and 11.16.0. The same stale figure appears in `docs/SECURITY_DESIGN.md:668` ("mermaid 10.9.6 and MathJax 3.2.2"). **Why this must be fixed before publication:** this is the first paragraph a security reader looks up, and it reads as a half-applied edit. Worse, it declares a vulnerable DOMPurify 3.4.11 that the product does not ship — an incorrect statement to third parties, and one that makes the product look *worse* than it is. Anyone who spots this stops believing the rest of SECURITY.md, including the many parts that are correct. **Proposal:** delete one of the two paragraphs, make the count ("one"/"three") match the number of bullets, drop the DOMPurify bullet that has already been carried out, and correct "mermaid 10.9.6" to 11.16.0 in both `SECURITY.md` and `docs/SECURITY_DESIGN.md:668`. One commit, no code change.

brenno added the

docs

bug

security

labels

2026-07-22 16:15:22 +00:00

brenno commented

2026-07-22 17:33:09 +00:00

Author

Owner

Opgelost in cc00070 (PR #655), en per abuis niet gesloten — de reactie hierover belandde op #578, dat over de gepinde CI-actions gaat.

De verouderde openingsalinea is weg en de inmiddels uitgevoerde DOMPurify-bullet ook; er blijft precies één onderhoudspost over (MathJax), wat de overgebleven alinea al zei. In docs/SECURITY_DESIGN.md is mermaid 10.9.6 naar 11.16.0 gegaan.

Vooraf getoetst: assets/web_export/MANIFEST.json pint DOMPurify 3.4.12 en mermaid 11.16.0, en de bestanden op schijf hashen daarnaar. Het document meldde dus een kwetsbaarheid in een versie die dit project niet uitlevert.

Geverifieerd op main: geen "Three tracked" meer, wel "One tracked (non-urgent)".

Opgelost in `cc00070` (PR #655), en per abuis niet gesloten — de reactie hierover belandde op #578, dat over de gepinde CI-actions gaat. De verouderde openingsalinea is weg en de inmiddels uitgevoerde DOMPurify-bullet ook; er blijft precies één onderhoudspost over (MathJax), wat de overgebleven alinea al zei. In `docs/SECURITY_DESIGN.md` is mermaid 10.9.6 naar 11.16.0 gegaan. Vooraf getoetst: `assets/web_export/MANIFEST.json` pint DOMPurify 3.4.12 en mermaid 11.16.0, en de bestanden op schijf hashen daarnaar. Het document meldde dus een kwetsbaarheid in een versie die dit project niet uitlevert. Geverifieerd op `main`: geen "Three tracked" meer, wel "One tracked (non-urgent)".

brenno closed this issue

2026-07-22 17:33:09 +00:00

brenno referenced this issue

2026-07-22 17:33:10 +00:00

[Bug] SECURITY_DESIGN claims CI Actions are pinned to exact versions; one of five is #578