Editor adversarial heading assertion includes a deliberately hidden block identity #1413

Open
opened 2026-10-07 22:32:44 +00:00 by kayg · 0 comments
Owner

Non-blocking editor probe mismatch from #1403's real-server adversarial round, seed 25608414.

Verbatim failure:

FINDING editor browser editor paste, Unicode, and block actions seed=25608414: Expected values to be strictly equal:
+ actual - expected
+ 'Anchor heading ^lxm7nh'
- 'Anchor heading'

The assertion at tests/adversarial/editor.mjs:677 reads raw textContent after Copy link adds a real block identity. BlockIdAnchorDecoration in packages/editor/src/extensions.ts deliberately retains that identity in the document while marking it aria-hidden="true", contenteditable="false", and display: none; user-select: none. Raw textContent includes the hidden identity. The later heading-deep-link predicate also compares raw textContent with the undecorated label.

The run separately reports two HTTP 400 image-proxy responses for a pasted loopback URL; the source fixture deliberately tests hostile paste. Determine which network denials the editor probe should classify as expected, rather than accepting unexpected browser errors.

Keep the current assertions until the owner reviews the intended visible-text/identity contract. Do not strip persistent IDs from the source or weaken paste sanitization to pass this check.

No data corruption or sync collision is shown: untouched bytes/mtime, nested Markdown, 10k blocks, a one-megabyte paragraph, concurrent same-block edits, offline reconciliation, delete/edit, external write and server restart all passed in this run. The browser-actions area stopped at this assertion, so its remaining history/deep-link checks are unverified.

Non-blocking editor probe mismatch from #1403's real-server adversarial round, seed 25608414. Verbatim failure: ``` FINDING editor browser editor paste, Unicode, and block actions seed=25608414: Expected values to be strictly equal: + actual - expected + 'Anchor heading ^lxm7nh' - 'Anchor heading' ``` The assertion at `tests/adversarial/editor.mjs:677` reads raw `textContent` after Copy link adds a real block identity. `BlockIdAnchorDecoration` in `packages/editor/src/extensions.ts` deliberately retains that identity in the document while marking it `aria-hidden="true"`, `contenteditable="false"`, and `display: none; user-select: none`. Raw textContent includes the hidden identity. The later heading-deep-link predicate also compares raw textContent with the undecorated label. The run separately reports two HTTP 400 image-proxy responses for a pasted loopback URL; the source fixture deliberately tests hostile paste. Determine which network denials the editor probe should classify as expected, rather than accepting unexpected browser errors. Keep the current assertions until the owner reviews the intended visible-text/identity contract. Do not strip persistent IDs from the source or weaken paste sanitization to pass this check. No data corruption or sync collision is shown: untouched bytes/mtime, nested Markdown, 10k blocks, a one-megabyte paragraph, concurrent same-block edits, offline reconciliation, delete/edit, external write and server restart all passed in this run. The browser-actions area stopped at this assertion, so its remaining history/deep-link checks are unverified.
Commenting is not possible because the repository is archived.
No labels
No milestone
No project
No assignees
1 participant
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
kayg/calternal-v0#1413
No description provided.