Diagnostic report and comparison security acceptance: exact reviewed text, safe rendering #363

Activity

1. raiseCatError

   added

   area:uiUI and visual presentationUI and visual presentation

   type:bugBug or defectBug or defect

   on Oct 10, 2026
2. raiseCatError commented on Oct 10, 2026

   

   raiseCatError

   on Oct 10, 2026

   OwnerAuthor

   More actions

   Verified against current heads (#360 79e3f40, #361 dafd69f).

   Fixed this pass

   • Plain diff copy (c) sent raw output to the clipboard (escape bytes, bidi/invisible characters). It now uses the report character policy, and the copy note says when it looks sensitive and was not redacted (r reviews and redacts).
   • The comparison report sized its fence before hidden characters and U+2028 were removed, so they could close it. The diff is cleaned first.
   • Side labels used single-backtick inline code; now delimiter-sized and single-line.
   • Report Directory/Status facts accepted line breaks and backticks; now folded to one line.

   Checked, not reproducible: scanner/review/clipboard differential, token splitting with zero-width, combining and full-width characters, bidi controls in key names, private paths, URL credentials, auth headers, edited text (rescanned, labelled not redacted).

   Tests: tests/compareSecurity.test.ts, additions to tests/copyReport.test.ts; typecheck clean; compare/report unit and live PTY tests pass. The full suite showed load-related timeouts in unrelated live/fuzzy tests that pass alone. Redaction remains pattern-based, not a guarantee. Not yet covered: physical clipboard behavior in a real terminal host.
3. raiseCatError commented on Oct 11, 2026

   

   raiseCatError

   on Oct 11, 2026

   OwnerAuthor

   More actions

   Security acceptance follow-up on the additive local workflow candidates; published #360/#361 updates and final Actions are pending.

   Confirmed additional authored-UI injection: restored command text in the Compare chooser's “with …” header bypassed display sanitization. 5570d347a3d4cdfb4ae9cbb1407bf36ee1f67806 sanitizes that label consistently with the picker/diff. Format and Unicode separator controls become visible in authored review UI. Actual plain diff clipboard output remains sanitized.

   Confirmed Markdown structure injection: restored lifecycleText was a raw Status fact in a report. 25af5ba6ff06e027c983f777c30d13704ee5e16a uses the existing delimiter-sized inline-code representation for that fact, including ordinary statuses. A hostile regression covers HTML, links and backtick delimiters. Plain reports retain their factual format.

   The existing live Report assertion was stale after that security fix. ee5483e5756351d3894cb0abc92e7653f135bbb7 corrects the assertion and its misleading title. Focused macOS checks passed:

   • tests/copySelectionLive.test.ts
   • tests/copyReport.test.ts
   • tests/copyReportLive.test.ts
   • tests/clipboard.test.ts

   They exercised explicit report review, cancel preserving clipboard contents, final sanitized/redacted clipboard bytes, restored transcripts, narrow/NO_COLOR/Safe presentation, backend failure/timeout/size bounds and EPIPE. Earlier focused comparison security/clipboard and hostile pin tests passed; the full final cross-feature gates are running again.

   Current report candidate: d51e80f3b826216baee34c626c30ff1c1247e5d7.
   Current comparison candidate: eb4fdf9eae3f4deb9f65bb17ee6156217607c13b.
   Current combined workflow candidate: 5e45e87e633746ee18263619e4438d834befef5c.

   The secret scanner remains best-effort. This is headless evidence with test clipboard backends, not physical terminal validation or a comprehensive-redaction guarantee. The shared frontend is not frozen.