Artifact [945d210697]

Artifact 945d210697b57f39df9f9ced0529b2bceb82aae5d9ccfcb38cbe2ffc77ccc9ab:

• File third_party/sanitizer-corpus/gitea.json — part of check-in [5ba3499b8a] at 2026-08-15 11:20:48 on branch trunk — markup: goldmark + cleanroom sanitizer + resolver seam (0002 §2)

  Two-lineage conformance corpus in third_party (ledger rows, inputs only); parse-oracle fuzz target; [[wiki]]/hash resolution post-sanitize. (user: dmestas, size: 2856) [annotate] [blame] [check-ins using]

{
  "source": "Gitea — modules/markup/sanitizer_default_test.go (MIT); inputs only, as attack/preservation vectors. Quarry's sanitizer policy is a cleanroom implementation; expected outputs are safety predicates, not Gitea's rendered bytes.",
  "cases": [
    {"name": "event handler stripped", "input": "<a onblur=\"alert(secret)\" href=\"http://www.google.com\">Google</a>", "deny": ["onblur", "alert"], "allow": ["href=\"http://www.google.com\""]},
    {"name": "homoglyph script tag", "input": "<scrİpt>&lt;script&gt;alert(document.domain)&lt;/script&gt;</scrİpt>", "deny": ["<script", "<scrİpt"]},
    {"name": "random code class stripped", "input": "<code class=\"random string\"></code>", "deny": ["random string"]},
    {"name": "code class ui injection", "input": "<code class=\"language-random ui tab active menu attached animating sidebar following bar center\"></code>", "deny": ["ui tab"]},
    {"name": "encoded code class injection", "input": "<code class=\"language-random&#32;ui&#32;tab&#32;active&#32;menu&#32;attached&#32;animating&#32;sidebar&#32;following&#32;bar&#32;center\"></code>", "deny": ["ui tab", "ui&#32;tab"]},
    {"name": "hidden input dropped", "input": "<input type=\"hidden\">", "deny": ["hidden"]},
    {"name": "checkbox kept", "input": "<input type=\"checkbox\">", "allow": ["type=\"checkbox\""]},
    {"name": "autofocus dropped", "input": "<input checked disabled autofocus>", "deny": ["autofocus"]},
    {"name": "kbd kept", "input": "<kbd>Ctrl + C</kbd>", "allow": ["<kbd>Ctrl + C</kbd>"]},
    {"name": "framework icon classes stripped", "input": "<i class=\"dropdown icon\">NAUGHTY</i>", "deny": ["dropdown"]},
    {"name": "span color style kept", "input": "<span style=\"color: red\">Hello World</span>", "allow": ["color: red"]},
    {"name": "unknown style property stripped", "input": "<span style=\"bad-color: red\">Hello World</span>", "deny": ["bad-color"]},
    {"name": "code style stripped", "input": "<code style=\"color: red\">Hello World</code>", "deny": ["style"]},
    {"name": "javascript href", "input": "<a href=\"javascript:alert('xss')\">bad</a>", "deny": ["javascript:"]},
    {"name": "vbscript href", "input": "<a href=\"vbscript:no\">bad</a>", "deny": ["vbscript:"]},
    {"name": "data href", "input": "<a href=\"data:1234\">bad</a>", "deny": ["data:1234"]},
    {"name": "frontend action classes stripped", "input": "<div class=\"link-action\" data-attr-class=\"foo\" data-url=\"xxx\">txt</div>", "deny": ["link-action", "data-url"]},
    {"name": "frontend fetch classes stripped", "input": "<div class=\"form-fetch-action\" data-global-init=\"a\" data-global-click=\"b\">txt</div>", "deny": ["form-fetch-action", "data-global-init", "data-global-click"]},
    {"name": "task list item class kept", "input": "<li class=\"checked\"></li>", "allow": ["class=\"checked\""]}
  ]
}