From 1b1fa2e6bca752fc982deb650fc0d0e96510c819 Mon Sep 17 00:00:00 2001 From: louis Date: Tue, 2 Jun 2026 12:33:26 -0400 Subject: [PATCH] fix(audit): update markdown test status and remove stale cross-realm KNOWN note MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit PR #5714 (markdown sanitize library) merged 2026-05-28 — test headers updated to reflect that p/nt/markdown/sanitize/v0 is now available. Test realms deliberately retain the unsafe pattern to document the risk for realm authors. PR #5330 and #5758 (cross-realm panic/recover fixes) both merged — remove the stale KNOWN note from audit_cross_realm_recover. --- tests/samourai-crew/run_tests.sh | 15 +++++++-------- .../security-markdown/audit_md_blockquote.sh | 6 +++--- .../security-markdown/audit_md_html_inject.sh | 6 +++--- .../security-markdown/audit_md_image_tracking.sh | 11 +++++------ .../security-markdown/audit_md_link_hijack.sh | 9 +++++---- .../security-markdown/audit_md_title_leak.sh | 8 +++++--- 6 files changed, 28 insertions(+), 27 deletions(-) diff --git a/tests/samourai-crew/run_tests.sh b/tests/samourai-crew/run_tests.sh index beda8cc..f854465 100755 --- a/tests/samourai-crew/run_tests.sh +++ b/tests/samourai-crew/run_tests.sh @@ -173,8 +173,7 @@ if [ "$MODE" = "one-shot" ] || [ "$MODE" = "all" ]; then run_test "audit_byteslice" /tests/audit/audit_byteslice.sh run_test "audit_array_alias" /tests/audit/audit_array_alias.sh run_test "audit_var_init_order" /tests/audit/audit_var_init_order.sh - run_test "audit_cross_realm_recover" /tests/audit/audit_cross_realm_recover.sh \ - "broader pattern not yet fixed, see f87249327" + run_test "audit_cross_realm_recover" /tests/audit/audit_cross_realm_recover.sh echo "" echo "=== E2E Tests (one-shot) ===" @@ -182,17 +181,17 @@ if [ "$MODE" = "one-shot" ] || [ "$MODE" = "all" ]; then run_test "e2e_mempool_stress" /tests/e2e/e2e_mempool_stress.sh echo "" - echo "=== Security Markdown Audit (KNOWN VULNERABLE — gnolang/gno#5714) ===" + echo "=== Security Markdown Audit (PR #5714 merged — sanitize library opt-in) ===" run_test "audit_md_title_leak" /tests/security-markdown/audit_md_title_leak.sh \ - "Render() returns unsanitized title, see gnolang/gno#5714" + "naive realm without sanitize.InlineText — unsafe pattern documented, see gnolang/gno#5714" run_test "audit_md_html_inject" /tests/security-markdown/audit_md_html_inject.sh \ - "Render() returns raw HTML tag, see gnolang/gno#5714" + "naive realm without sanitize.Block — unsafe pattern documented, see gnolang/gno#5714" run_test "audit_md_link_hijack" /tests/security-markdown/audit_md_link_hijack.sh \ - "Render() returns hijacked link URL, see gnolang/gno#5714" + "naive realm without sanitize.URL — unsafe pattern documented, see gnolang/gno#5714" run_test "audit_md_blockquote" /tests/security-markdown/audit_md_blockquote.sh \ - "Render() returns injected blockquote, see gnolang/gno#5714" + "naive realm without sanitize.Block — unsafe pattern documented, see gnolang/gno#5714" run_test "audit_md_image_tracking" /tests/security-markdown/audit_md_image_tracking.sh \ - "Render() returns external image URL, see gnolang/gno#5714" + "naive realm without sanitize.ImageURL — unsafe pattern documented, see gnolang/gno#5714" echo "" echo "=== Stress Tests ===" diff --git a/tests/samourai-crew/security-markdown/audit_md_blockquote.sh b/tests/samourai-crew/security-markdown/audit_md_blockquote.sh index 6d434ad..481c906 100755 --- a/tests/samourai-crew/security-markdown/audit_md_blockquote.sh +++ b/tests/samourai-crew/security-markdown/audit_md_blockquote.sh @@ -1,9 +1,9 @@ #!/bin/sh # Targets: gnolang/gno#5714 — markdown injection in Render() +# PR #5714 MERGED (2026-05-28): p/nt/markdown/sanitize/v0 library now available. # Vector: blockquote context confusion -# A user-controlled comment can inject a blockquote that visually mimics -# an official statement from the core team. -# KNOWN VULNERABLE on current master — expected regression until #5714 is fixed. +# This test realm deliberately omits sanitize.Block() to document the risk of +# naive comment-aggregation patterns. Realm authors must call sanitize helpers explicitly. SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" # shellcheck source=common.sh diff --git a/tests/samourai-crew/security-markdown/audit_md_html_inject.sh b/tests/samourai-crew/security-markdown/audit_md_html_inject.sh index d78c997..f88b600 100755 --- a/tests/samourai-crew/security-markdown/audit_md_html_inject.sh +++ b/tests/samourai-crew/security-markdown/audit_md_html_inject.sh @@ -1,9 +1,9 @@ #!/bin/sh # Targets: gnolang/gno#5714 — markdown injection in Render() +# PR #5714 MERGED (2026-05-28): p/nt/markdown/sanitize/v0 library now available. # Vector: raw HTML injection -# User-supplied HTML content is returned verbatim by Render() and may be -# rendered by the browser on gno.land if gnoweb does not escape it. -# KNOWN VULNERABLE on current master — expected regression until #5714 is fixed. +# This test realm deliberately omits sanitize.Block() to document the risk of +# naive Render() implementations. Realm authors must call sanitize helpers explicitly. SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" # shellcheck source=common.sh diff --git a/tests/samourai-crew/security-markdown/audit_md_image_tracking.sh b/tests/samourai-crew/security-markdown/audit_md_image_tracking.sh index 1af6d25..8f9394b 100755 --- a/tests/samourai-crew/security-markdown/audit_md_image_tracking.sh +++ b/tests/samourai-crew/security-markdown/audit_md_image_tracking.sh @@ -1,11 +1,10 @@ #!/bin/sh # Targets: gnolang/gno#5714 — markdown injection in Render() -# Vector: external image tracking pixel -# An attacker who can inject markdown into Render() can embed an external image -# URL. Gnoweb renders it as , causing every -# visitor's browser to load the external resource — deanonymizing viewers. -# If gnoweb ever fetches images server-side, this also becomes an SSRF vector. -# KNOWN VULNERABLE on current master — expected regression until #5714 is fixed. +# PR #5714 MERGED (2026-05-28): p/nt/markdown/sanitize/v0 library now available. +# Vector: external image tracking pixel (deanonymization + SSRF) +# This test realm deliberately omits sanitize.ImageURL() to document the risk. +# Without it, gnoweb renders on every page view. +# Realm authors must call sanitize.ImageURL() on any user-supplied image src. SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" # shellcheck source=common.sh diff --git a/tests/samourai-crew/security-markdown/audit_md_link_hijack.sh b/tests/samourai-crew/security-markdown/audit_md_link_hijack.sh index 2c9de58..1567779 100755 --- a/tests/samourai-crew/security-markdown/audit_md_link_hijack.sh +++ b/tests/samourai-crew/security-markdown/audit_md_link_hijack.sh @@ -1,9 +1,10 @@ #!/bin/sh # Targets: gnolang/gno#5714 — markdown injection in Render() -# Vector: link URL hijacking -# A user-controlled message can contain a link whose display text resembles -# an official URL while the actual href points to a malicious destination. -# KNOWN VULNERABLE on current master — expected regression until #5714 is fixed. +# PR #5714 MERGED (2026-05-28): p/nt/markdown/sanitize/v0 library now available. +# Vector: link URL hijacking (phishing) +# This test realm deliberately omits sanitize.URL() to document the risk. +# Display text mimics an official URL while href points to a malicious destination. +# Realm authors must call sanitize.URL() on any user-supplied link href. SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" # shellcheck source=common.sh diff --git a/tests/samourai-crew/security-markdown/audit_md_title_leak.sh b/tests/samourai-crew/security-markdown/audit_md_title_leak.sh index 551dc7e..350ba59 100755 --- a/tests/samourai-crew/security-markdown/audit_md_title_leak.sh +++ b/tests/samourai-crew/security-markdown/audit_md_title_leak.sh @@ -1,8 +1,10 @@ #!/bin/sh # Targets: gnolang/gno#5714 — markdown injection in Render() -# Vector: user-controlled title injected unsanitized into markdown body, -# allowing arbitrary headings to be rendered in a proposal or page. -# KNOWN VULNERABLE on current master — expected regression until #5714 is fixed. +# PR #5714 MERGED (2026-05-28): p/nt/markdown/sanitize/v0 library now available. +# Vector: title leak into body (heading injection via embedded newlines) +# This test realm deliberately omits sanitize.InlineText() on the title field. +# Without it, newlines in user-supplied titles escape into the markdown body. +# Realm authors must call sanitize.InlineText() on any user-supplied single-line field. SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)" # shellcheck source=common.sh