Tag Photo/XMP probe uploads plain text in its JPEG fixture #1264

Open
opened 2026-10-07 00:03:09 +00:00 by kayg · 0 comments
Owner

Tag probe uses plain text as its Photo fixture (#1202)

On product 139d4378e, the global Tag/XMP part of tests/adversarial/attack.py uploads Travel/beach.jpg using b"test image payload" at line 3324. Its later checks require kind: photo and a .jpg.xmp sidecar. The actual Tag projections contain the Note and two Files; the text-backed .jpg is a File and its expected XMP file does not exist.

Findings include global Tag page, rewrite preview/source kinds, renamed page, XMP source read, corrupt XMP source setup and rebuild source kinds. The returned paths still contain the three fixture sources; no source loss was observed. This fixture cannot prove a Tag/XMP failure with a valid Photo. The job leaves the old fixture and expectations intact, per the rule against changing them to make a test pass. The orchestrator should review the intended MIME/content classification and use an existing valid image fixture for the Photo-specific regression.

The new round-31 Hide probe uses a valid decoded 1×1 PNG; its hide/unhide and protocol checks passed. The shared source-byte contracts also passed all 12 cases. This issue records the older global Tag fixture gap; it does not establish an authorization hole or loss of image data.

Tag probe uses plain text as its Photo fixture (#1202) On product `139d4378e`, the global Tag/XMP part of `tests/adversarial/attack.py` uploads `Travel/beach.jpg` using `b"test image payload"` at line 3324. Its later checks require `kind: photo` and a `.jpg.xmp` sidecar. The actual Tag projections contain the Note and two Files; the text-backed `.jpg` is a File and its expected XMP file does not exist. Findings include global Tag page, rewrite preview/source kinds, renamed page, XMP source read, corrupt XMP source setup and rebuild source kinds. The returned paths still contain the three fixture sources; no source loss was observed. This fixture cannot prove a Tag/XMP failure with a valid Photo. The job leaves the old fixture and expectations intact, per the rule against changing them to make a test pass. The orchestrator should review the intended MIME/content classification and use an existing valid image fixture for the Photo-specific regression. The new round-31 Hide probe uses a valid decoded 1×1 PNG; its hide/unhide and protocol checks passed. The shared source-byte contracts also passed all 12 cases. This issue records the older global Tag fixture gap; it does not establish an authorization hole or loss of image data.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1264
No description provided.