Skip to content

fix(audit): update markdown test status and remove stale cross-realm … #5

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
louis14448 merged 1 commit into from
Jun 2, 2026
Merged

fix(audit): update markdown test status and remove stale cross-realm … #5

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
15 changes: 7 additions & 8 deletions tests/samourai-crew/run_tests.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -173,26 +173,25 @@ if [ "$MODE" = "one-shot" ] || [ "$MODE" = "all" ]; then
run_test "audit_byteslice" /tests/audit/audit_byteslice.sh
run_test "audit_array_alias" /tests/audit/audit_array_alias.sh
run_test "audit_var_init_order" /tests/audit/audit_var_init_order.sh
run_test "audit_cross_realm_recover" /tests/audit/audit_cross_realm_recover.sh \
"broader pattern not yet fixed, see f87249327"
run_test "audit_cross_realm_recover" /tests/audit/audit_cross_realm_recover.sh

echo ""
echo "=== E2E Tests (one-shot) ==="
run_test "e2e_counter" /tests/e2e/e2e_counter.sh
run_test "e2e_mempool_stress" /tests/e2e/e2e_mempool_stress.sh

echo ""
echo "=== Security Markdown Audit (KNOWN VULNERABLE — gnolang/gno#5714) ==="
echo "=== Security Markdown Audit (PR #5714 merged — sanitize library opt-in) ==="
run_test "audit_md_title_leak" /tests/security-markdown/audit_md_title_leak.sh \
"Render() returns unsanitized title, see gnolang/gno#5714"
"naive realm without sanitize.InlineText — unsafe pattern documented, see gnolang/gno#5714"
run_test "audit_md_html_inject" /tests/security-markdown/audit_md_html_inject.sh \
"Render() returns raw HTML tag, see gnolang/gno#5714"
"naive realm without sanitize.Block — unsafe pattern documented, see gnolang/gno#5714"
run_test "audit_md_link_hijack" /tests/security-markdown/audit_md_link_hijack.sh \
"Render() returns hijacked link URL, see gnolang/gno#5714"
"naive realm without sanitize.URL — unsafe pattern documented, see gnolang/gno#5714"
run_test "audit_md_blockquote" /tests/security-markdown/audit_md_blockquote.sh \
"Render() returns injected blockquote, see gnolang/gno#5714"
"naive realm without sanitize.Block — unsafe pattern documented, see gnolang/gno#5714"
run_test "audit_md_image_tracking" /tests/security-markdown/audit_md_image_tracking.sh \
"Render() returns external image URL, see gnolang/gno#5714"
"naive realm without sanitize.ImageURL — unsafe pattern documented, see gnolang/gno#5714"

echo ""
echo "=== Stress Tests ==="
Expand Down
6 changes: 3 additions & 3 deletions tests/samourai-crew/security-markdown/audit_md_blockquote.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
#!/bin/sh
# Targets: gnolang/gno#5714 — markdown injection in Render()
# PR #5714 MERGED (2026-05-28): p/nt/markdown/sanitize/v0 library now available.
# Vector: blockquote context confusion
# A user-controlled comment can inject a blockquote that visually mimics
# an official statement from the core team.
# KNOWN VULNERABLE on current master — expected regression until #5714 is fixed.
# This test realm deliberately omits sanitize.Block() to document the risk of
# naive comment-aggregation patterns. Realm authors must call sanitize helpers explicitly.

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
# shellcheck source=common.sh
Expand Down
6 changes: 3 additions & 3 deletions tests/samourai-crew/security-markdown/audit_md_html_inject.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,9 @@
#!/bin/sh
# Targets: gnolang/gno#5714 — markdown injection in Render()
# PR #5714 MERGED (2026-05-28): p/nt/markdown/sanitize/v0 library now available.
# Vector: raw HTML injection
# User-supplied HTML content is returned verbatim by Render() and may be
# rendered by the browser on gno.land if gnoweb does not escape it.
# KNOWN VULNERABLE on current master — expected regression until #5714 is fixed.
# This test realm deliberately omits sanitize.Block() to document the risk of
# naive Render() implementations. Realm authors must call sanitize helpers explicitly.

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
# shellcheck source=common.sh
Expand Down
11 changes: 5 additions & 6 deletions tests/samourai-crew/security-markdown/audit_md_image_tracking.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,10 @@
#!/bin/sh
# Targets: gnolang/gno#5714 — markdown injection in Render()
# Vector: external image tracking pixel
# An attacker who can inject markdown into Render() can embed an external image
# URL. Gnoweb renders it as <img src="https://attacker.com/...">, causing every
# visitor's browser to load the external resource — deanonymizing viewers.
# If gnoweb ever fetches images server-side, this also becomes an SSRF vector.
# KNOWN VULNERABLE on current master — expected regression until #5714 is fixed.
# PR #5714 MERGED (2026-05-28): p/nt/markdown/sanitize/v0 library now available.
# Vector: external image tracking pixel (deanonymization + SSRF)
# This test realm deliberately omits sanitize.ImageURL() to document the risk.
# Without it, gnoweb renders <img src="https://attacker.com/..."> on every page view.
# Realm authors must call sanitize.ImageURL() on any user-supplied image src.

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
# shellcheck source=common.sh
Expand Down
9 changes: 5 additions & 4 deletions tests/samourai-crew/security-markdown/audit_md_link_hijack.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,9 +1,10 @@
#!/bin/sh
# Targets: gnolang/gno#5714 — markdown injection in Render()
# Vector: link URL hijacking
# A user-controlled message can contain a link whose display text resembles
# an official URL while the actual href points to a malicious destination.
# KNOWN VULNERABLE on current master — expected regression until #5714 is fixed.
# PR #5714 MERGED (2026-05-28): p/nt/markdown/sanitize/v0 library now available.
# Vector: link URL hijacking (phishing)
# This test realm deliberately omits sanitize.URL() to document the risk.
# Display text mimics an official URL while href points to a malicious destination.
# Realm authors must call sanitize.URL() on any user-supplied link href.

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
# shellcheck source=common.sh
Expand Down
8 changes: 5 additions & 3 deletions tests/samourai-crew/security-markdown/audit_md_title_leak.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,8 +1,10 @@
#!/bin/sh
# Targets: gnolang/gno#5714 — markdown injection in Render()
# Vector: user-controlled title injected unsanitized into markdown body,
# allowing arbitrary headings to be rendered in a proposal or page.
# KNOWN VULNERABLE on current master — expected regression until #5714 is fixed.
# PR #5714 MERGED (2026-05-28): p/nt/markdown/sanitize/v0 library now available.
# Vector: title leak into body (heading injection via embedded newlines)
# This test realm deliberately omits sanitize.InlineText() on the title field.
# Without it, newlines in user-supplied titles escape into the markdown body.
# Realm authors must call sanitize.InlineText() on any user-supplied single-line field.

SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
# shellcheck source=common.sh
Expand Down
Loading