LibreKAT/Ocideck
LibreKAT/Ocideck
Watch
4
0
Fork
You've already forked Ocideck
 1
Code Issues Pull requests Projects Releases 21 Packages Activity Actions

fix(security): harden document input and asset boundaries #1696

Merged
brenno merged 1 commit from codex/security-1690-1693 into main 2026-08-21 22:25:37 +00:00
Conversation 0 Commits 1 Files changed 8 +104 -29
brenno commented 2026-08-21 22:09:43 +00:00
Owner
Copy link

Samenvatting

  • weigert projectinterne afbeeldingssymlinks die buiten het project wijzen voordat bytes naar export-, AI- of repositorypaden gaan
  • hercontroleert positieve render-containment en cachet alleen fail-closed blokkades
  • detecteert inline HTML-eventhandlers die direct na een solidus staan
  • past de 32 MiB-limiet toe op de werkelijke UTF-8-byteomvang zonder een tweede grote buffer te alloceren
  • voegt voor ieder scenario een gerichte regressietest toe

Validatie

  • make check — 10.290 tests geslaagd; 87,2% line coverage
  • make sast — 0 bevindingen
  • gerichte tests — 66 tests geslaagd

Closes #1690
Closes #1691
Closes #1692
Closes #1693

## Samenvatting - weigert projectinterne afbeeldingssymlinks die buiten het project wijzen voordat bytes naar export-, AI- of repositorypaden gaan - hercontroleert positieve render-containment en cachet alleen fail-closed blokkades - detecteert inline HTML-eventhandlers die direct na een solidus staan - past de 32 MiB-limiet toe op de werkelijke UTF-8-byteomvang zonder een tweede grote buffer te alloceren - voegt voor ieder scenario een gerichte regressietest toe ## Validatie - `make check` — 10.290 tests geslaagd; 87,2% line coverage - `make sast` — 0 bevindingen - gerichte tests — 66 tests geslaagd Closes #1690 Closes #1691 Closes #1692 Closes #1693
fix(security): harden document input and asset boundaries
All checks were successful
scans / scans (pull_request) Successful in 4m47s
Details
static-gate / static-gate (pull_request) Successful in 7m42s
Details
c9da5d1fcb
brenno changed title from WIP: fix(security): harden document input and asset boundaries to fix(security): harden document input and asset boundaries 2026-08-21 22:25:26 +00:00
brenno merged commit 022886f9c5 into main 2026-08-21 22:25:37 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels   
accepted
Assessed and will be built

  
bug
Something is broken

  
declined
Assessed and will not be built

  
docs
Documentation only

  
duplicate
Already tracked elsewhere

  
enhancement
New feature or improvement request

  
good first issue
Small, self-contained, and a good place to start

  
in-progress
Someone is working on this right now. Do not start it in parallel.

  
needs-info
Waiting for the reporter

  
privacy
Personal data can leak. Handled before anything else.

  
security
A weakness someone could use. Handled before anything else.

  
triage
Awaiting assessment

No labels
accepted
bug
declined
docs
duplicate
enhancement
good first issue
in-progress
needs-info
privacy
security
triage
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
LibreKAT/Ocideck!1696
No description provided.