test(security): add reproducible parser fuzzing and assurance evidence #30

New Issue

2026-10-12T04:01:04Z

KofTwentyTwo commented

2026-10-12 04:01:04 +00:00

(Migrated from github.com)

The current published standards checker (standards commit1cc9d01) identifies missing docs/security/assurance.json and mandatory K22-TEST-25 parser campaigns in this public Product app. Example-based security tests alone do not meet that requirement.

Implement bounded reproducible mutation/property targets for untrusted Markdown/HTML, source positions/folds, document resource requests and imported theme JSON. Assert passive DOM, literal-source boundaries, scoped URLs and theme/title HTML containment; a crash-only campaign is insufficient. Never execute generated content or write to a real profile.

Run merge-gating campaigns on PR/main plus longer weekly and pre-MAJOR/MINOR campaigns, retain failing synthetic seeds/inputs, document replay/minimization, add the real assurance record and keep100% core measured line coverage. Preserve existing desktop cases/deadlines. Owner Best Practices enrollment and shared inventory are separate requirements, not reasons to mark fuzzing inapplicable.

Implementation and actual verification pending. Substantial AI assistance: Codex.

The current published standards checker (`standards` commit1cc9d01) identifies missing `docs/security/assurance.json` and mandatory K22-TEST-25 parser campaigns in this public Product app. Example-based security tests alone do not meet that requirement. Implement bounded reproducible mutation/property targets for untrusted Markdown/HTML, source positions/folds, document resource requests and imported theme JSON. Assert passive DOM, literal-source boundaries, scoped URLs and theme/title HTML containment; a crash-only campaign is insufficient. Never execute generated content or write to a real profile. Run merge-gating campaigns on PR/main plus longer weekly and pre-MAJOR/MINOR campaigns, retain failing synthetic seeds/inputs, document replay/minimization, add the real assurance record and keep100% core measured line coverage. Preserve existing desktop cases/deadlines. Owner Best Practices enrollment and shared inventory are separate requirements, not reasons to mark fuzzing inapplicable. Implementation and actual verification pending. Substantial AI assistance: Codex.

KofTwentyTwo commented

2026-10-12 05:16:48 +00:00

(Migrated from github.com)

Signed/DCOe6fd281 adds five real seeded parser/property targets, a dedicated PR/main/weekly/release gate and the actual assurance/replay record. Hosted fuzz38204215912 passes core9/9 and activation2/2, zero skips; local longer campaigns cover100000 generated inputs plus the minimized browser-relative backslash regression. Full677 core/100%, zero-warning Release/format,64 tooling tests and lint/hooks pass. An oracle error was diagnosed and retained; no production vulnerability or coverage-guided/exhaustive claim is invented.

Current standards checker finds the targets and real run command (REVIEW), with actual badge enrollment and shared inventory still FAIL. The prepared fuzzing ruleset addition is not applied until required automated bootstrap gates pass.

Exacte6 full native111/focused28 pass, but published picker cancellation fails and the suite reaches600seconds, so installed phases are unverified. Candidate d0526ef activates the owned Settings action and retains all selectors/assertions/deadlines; fresh hosted proof required. Issue stays open. Substantial AI assistance: Codex.

Signed/DCOe6fd281 adds five real seeded parser/property targets, a dedicated PR/main/weekly/release gate and the actual assurance/replay record. Hosted fuzz38204215912 passes core9/9 and activation2/2, zero skips; local longer campaigns cover100000 generated inputs plus the minimized browser-relative backslash regression. Full677 core/100%, zero-warning Release/format,64 tooling tests and lint/hooks pass. An oracle error was diagnosed and retained; no production vulnerability or coverage-guided/exhaustive claim is invented. Current standards checker finds the targets and real run command (REVIEW), with actual badge enrollment and shared inventory still FAIL. The prepared `fuzzing` ruleset addition is not applied until required automated bootstrap gates pass. Exacte6 full native111/focused28 pass, but published picker cancellation fails and the suite reaches600seconds, so installed phases are unverified. Candidate d0526ef activates the owned Settings action and retains all selectors/assertions/deadlines; fresh hosted proof required. Issue stays open. Substantial AI assistance: Codex.

KofTwentyTwo commented

2026-10-12 19:16:57 +00:00

(Migrated from github.com)

Implemented in the owner-reviewed application tree, merged via PR35 at38dd5c1. The deterministic campaigns cover Markdown/HTML, source ranges/folds, resource URLs, theme imports, and activation envelopes with independent security properties. Long local campaigns passed100000 generated inputs; no mutation-score or exhaustive parser claim is made.

Hosted PR/main campaigns pass, including https://github.com/KofTwentyTwo/MarkdownViewr.Windows/actions/runs/38294894044. The release workflow requires the long tag campaign before publication. The live main ruleset now requires the Actions-bound fuzzing context; repository setup Validate confirms18 required contexts while preserving every other rule.

Assurance record, replay/minimization guidance and retained synthetic failures/results are committed. The genuine owner review covers this exact tree. Closing this implementation issue; remaining production signing/publication is tracked in#33 and the honest saved70% OpenSSF assessment in#31.

Implemented in the owner-reviewed application tree, merged via PR35 at38dd5c1. The deterministic campaigns cover Markdown/HTML, source ranges/folds, resource URLs, theme imports, and activation envelopes with independent security properties. Long local campaigns passed100000 generated inputs; no mutation-score or exhaustive parser claim is made. Hosted PR/main campaigns pass, including https://github.com/KofTwentyTwo/MarkdownViewr.Windows/actions/runs/38294894044. The release workflow requires the long tag campaign before publication. The live main ruleset now requires the Actions-bound `fuzzing` context; repository setup Validate confirms18 required contexts while preserving every other rule. Assurance record, replay/minimization guidance and retained synthetic failures/results are committed. The genuine owner review covers this exact tree. Closing this implementation issue; remaining production signing/publication is tracked in#33 and the honest saved70% OpenSSF assessment in#31.

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: KofTwentyTwo/MarkdownViewr.Windows#30