feat(quality): require snapshot secret masking and locked raw-echo properties - #8
Merged
Conversation
…operties Two rules the implementation already assumed but the specification never stated, so neither had an identifier a change could cite. F5-R26 covers the development system snapshot. It renders effective configuration and environment, and the masking rule has to match plural key forms: a retired key list decrypts the same data as the key in use, and a rule written for the singular does not see it. Where a key's sensitivity is uncertain the rule resolves toward masking, because the two errors are not symmetric — an over-masked row costs a lookup, an under-masked one publishes a secret to a screenshot or a support bundle. Q-R26 covers properties rendered as raw markup. An inline vector image is the honest case for a raw echo, since escaping stops it drawing. A serialisable component property is rehydrated from the client on every request, so "server-built markup" holds only for the first render; the lock is what makes the raw sink safe, and the two belong together. Spec: GOV-R13 Signed-off-by: Wessel Verheij <info@nightworks.io>
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two rules the implementation already assumed but this repository never stated.
Neither had an identifier, so a change that depended on either could not cite
one — which is what this PR fixes, ahead of the implementation change that
needs them.
F5-R26 — snapshot secret masking
The development system snapshot renders effective configuration and
environment. Masking is keyed on the name, and the rule has to match plural
forms as well as singular: a retired key list decrypts exactly the data the key
in use does, and a rule expressed for the singular alone does not match it.
The page also states which way an uncertain key resolves. The two errors are
not symmetric. An over-masked diagnostic row costs a reader one lookup. An
under-masked one publishes a secret to anything that can read the page, which
includes a screenshot and a support bundle.
Q-R26 — locked raw-echo properties
Output is escaped, with one honest exception: an inline vector image cannot be
escaped and still draw. Where a value is rendered as raw markup, the property
holding it is locked against client mutation.
The reasoning is specific to server-rendered components with a thin client
layer. A serialisable component property is rehydrated from the client on every
request, so "the server built this markup" describes the first render only.
Without the lock, the raw sink accepts whatever the client sends back. The lock
and the raw echo are a pair; adding or removing either alone is what makes the
sink unsafe.
Scope
Documentation only — three files, twenty added lines, no behavioural claim
withdrawn or altered.
just integrity,typosandmarkdownlint-cli2pass.Spec: GOV-R13