Artifact [7ea9430d4f]

Artifact 7ea9430d4f08428cd20ef5a2aaad2c5f47bc56def4a8d4b11296982d923c3025:

• File third_party/sanitizer-corpus/forgejo.json — part of check-in [5ba3499b8a] at 2026-08-15 11:20:48 on branch trunk — markup: goldmark + cleanroom sanitizer + resolver seam (0002 §2)

  Two-lineage conformance corpus in third_party (ledger rows, inputs only); parse-oracle fuzz target; [[wiki]]/hash resolution post-sanitize. (user: dmestas, size: 2290) [annotate] [blame] [check-ins using]

{
  "source": "Forgejo — modules/markup/sanitizer_test.go (GPL-3.0-or-later lineage; test inputs are data, taken with attribution); inputs only, as attack/preservation vectors. Quarry's sanitizer policy is a cleanroom implementation; expected outputs are safety predicates, not Forgejo's rendered bytes.",
  "cases": [
    {"name": "language class kept", "input": "<code class=\"language-go\"></code>", "allow": ["language-go"]},
    {"name": "emoji span kept", "input": "<span class=\"emoji\">contents</span>", "allow": ["class=\"emoji\"", "contents"]},
    {"name": "emoji dropdown stripped", "input": "<span class=\"emoji dropdown\">NAUGHTY</span>", "deny": ["dropdown"]},
    {"name": "emoji aria kept", "input": "<span class=\"emoji\" aria-label=\"thumbs up\" data-alias=\"+1\">THUMBS UP</span>", "allow": ["aria-label=\"thumbs up\""]},
    {"name": "table cell styles kept", "input": "<table><tr><th style=\"color: red\">TH1</th></tr><tr><td style=\"background-color: red\">TD1</td></tr></table>", "allow": ["<table>", "color: red", "background-color: red"]},
    {"name": "lazy image loading kept", "input": "<img src=\"/image1\" alt=\"image1\" loading=\"lazy\">", "allow": ["loading=\"lazy\""]},
    {"name": "eager image loading stripped", "input": "<img src=\"/image1\" alt=\"image1\" loading=\"eager\">", "deny": ["loading=\"eager\""], "allow": ["src=\"/image1\""]},
    {"name": "javascript href in prose", "input": "<a href=\"javascript:alert('xss')\">Click me</a>.", "deny": ["javascript:"]},
    {"name": "data html script href", "input": "<a href=\"data:text/html,<script>alert('xss')</script>\">Click me</a>.", "deny": ["data:text/html", "<script"]},
    {"name": "vbscript msgbox href", "input": "<a href=\"vbscript:msgbox(\\\"xss\\\")\">Click me</a>.", "deny": ["vbscript:"]},
    {"name": "custom scheme link kept", "input": "<a href=\"matrix:roomid/psumPMeAfzgAeQpXMG:feneas.org?action=join\">my custom URL scheme</a>", "allow": []},
    {"name": "details summary", "input": "<details>Click me! <summary>Nothing to see here.</summary></details>", "deny": ["<script"]},
    {"name": "basic emphasis kept", "input": "<b>I</b> have a <i>strong</i> <strong>opinion</strong> about <em>this</em>.", "allow": ["<b>I</b>", "<strong>opinion</strong>", "<em>this</em>"]}
  ]
}