BLOCKER: Public hidden-name Markdown preview exposes real names in headers #1280

Open
opened 2026-10-07 00:35:43 +00:00 by kayg · 1 comment
Owner

MERGE BLOCKER from adv31 / #1202

Product head 139d4378e. An anonymous visitor to the Public link audit-hidden, with hide_filenames=true, receives the real Quarterly/Audit source names in preview headers. The existing probe reports both leaks. Listings and downloads have separate hidden-name checks.

The bounded Markdown preview branch in crates/plugins/files/src/public.rs calls the shared user-byte header helper with located.relative, unlike the generic preview branch, which uses the existing download_name(link, relative) policy. The Markdown Content-Disposition therefore bypasses the hidden-name policy.

Reuse download_name for the bounded Markdown response and add a real-route regression. Preserve the existing leak assertions. This privacy leak blocks merge until repaired and verified.

## MERGE BLOCKER from adv31 / #1202 Product head 139d4378e. An anonymous visitor to the Public link `audit-hidden`, with hide_filenames=true, receives the real Quarterly/Audit source names in preview headers. The existing probe reports both leaks. Listings and downloads have separate hidden-name checks. The bounded Markdown preview branch in crates/plugins/files/src/public.rs calls the shared user-byte header helper with `located.relative`, unlike the generic preview branch, which uses the existing `download_name(link, relative)` policy. The Markdown Content-Disposition therefore bypasses the hidden-name policy. Reuse download_name for the bounded Markdown response and add a real-route regression. Preserve the existing leak assertions. This privacy leak blocks merge until repaired and verified.
Author
Owner

The #1202 continuation fixes this privacy blocker in commit 92f3f6c39; final head is c8fe092c3de1b1f388ecb2c71ae307de0447eaaa. The bounded Markdown branch now uses the existing download_name policy. Its real loopback HTTP regression walks 57 Public requests, including all preview types, headers, bodies, errors, thumbnail bytes and 304 ETags. It requires successful previews and no source-name bytes. The share-options runner also checks bodies and every header, including the link page.

test public::tests::hidden_names_stay_private_across_public_routes ... ok

Formatting, Clippy with warnings denied and web gates passed. The full Files run encountered existing #1213 cleanup. That test cleanup was repaired; its deterministic regression and unchanged stress scenario passed in focused reruns. The failed full attempt is preserved in #1202. No issue is closed.

Verification evidence.

The #1202 continuation fixes this privacy blocker in commit `92f3f6c39`; final head is `c8fe092c3de1b1f388ecb2c71ae307de0447eaaa`. The bounded Markdown branch now uses the existing `download_name` policy. Its real loopback HTTP regression walks 57 Public requests, including all preview types, headers, bodies, errors, thumbnail bytes and 304 ETags. It requires successful previews and no source-name bytes. The share-options runner also checks bodies and every header, including the link page. ``` test public::tests::hidden_names_stay_private_across_public_routes ... ok ``` Formatting, Clippy with warnings denied and web gates passed. The full Files run encountered existing #1213 cleanup. That test cleanup was repaired; its deterministic regression and unchanged stress scenario passed in focused reruns. The failed full attempt is preserved in #1202. No issue is closed. [Verification evidence](https://git.kayg.org/attachments/c3745492-657e-4397-a322-15c673c8e7f2).
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1280
No description provided.