M12-04C Status

status: done task: reject absolute paths, UNC/drive paths, controls, and origin escape updated: 2026-08-18 America/New_York enablingTask: false parityStateChange: false

Scope

The project-asset path gate rejects absolute POSIX paths, UNC and drive-shaped paths, NUL/control characters, malformed or residual percent encoding, and URI/origin-shaped escapes before a locator is accepted. HTTPS source policy entries are now strict credential-free origins: path, query, fragment, encoded controls, and backslash smuggling are rejected instead of being silently reduced to URL.origin. HTTPS resource paths retain the declared-origin check and reject unsafe decoded bytes.

Evidence

npm --prefix web run test:library-path-security passed 4/4 unit tests.
Absolute, UNC, drive, raw/encoded NUL and control characters, and origin-style project paths return stable ASSET_PATH_OUTSIDE_PROJECT/ASSET_PATH_INVALID errors.
Raw and encoded backslashes, controls, malformed percent sequences, credentials, undeclared origins, and policy origin smuggling return IO_EXTERNAL_URI_BLOCKED.
Declared https://assets.example.test/library/main.blend remains accepted; policy declarations with a path, query, fragment, encoded control, or duplicate canonical origin fail closed.
WEB_TEST_PORT=5323 npm --prefix web run test:asset-library passed the N-023 Chromium asset/IO gate 1/1.
npm --prefix web run typecheck passed.

Artifact Hashes

parent manifest: 8cd29c3f5281082584fc6aefe2ec385a2eedf8116e837a4db54c391391ff8f98
path normalizer: 6109d05251fc7355ac32d4c0d8298f85ea8b731767c76c394577c4e44652a6bf
source-origin protocol: 67a1808f225194a09a72987c5340c7494c5fa8d99dffde40664a11a779caedeb
unit: ab302cacb24634a3225dda5cb8f5282cb80b3bd81ed5c8900ddf4ff18267b7e2
manifest: a7f3a45eb7f68d022f38185a1c1409e1db1b27647fef587d66d2ffa52d78f98e
package commands: cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c

Next Task

M12-04D: resolve symlink/hardlink entries before writing and constrain them to the temporary root.

Rollback

Remove the C path-security assertions, manifest, status entry, and strict origin validation. Restore M12-04B to pending and move the machine queue back to M12-04C. No parity ledger rollback is required.

2.3 KiB Raw Blame History