Artifact [750f24c3c7]

Artifact 750f24c3c7683f8e25227f581a6b9ea9197c4aa5a19e0df53e2af9447e8f8fdc:

• File internal/xfer/container_test.go — part of check-in [9db9b2ebae] at 2026-08-16 02:18:13 on branch trunk — security: close whitespace-card sync-gate bypass; write-op input 400s

  Audit found a critical: scanRequest matched card keywords with a raw byte-prefix, so a push/login card indented by any Fossil-whitespace byte (SP/HTAB/VT/FF/CR) was invisible to the gate but still honored by the zit backend — an unauthenticated write to a gated repo. Now tokenizes exactly as zit's tokenizeCard (leading-whitespace-skipping), verified live. Also: gate GET edit/new pages (were ungated), reject control chars in wiki names (400 not 500), ticket.set no-fields 400 via new ops.ErrInvalid. (user: dmestas, size: 1549) [annotate] [blame] [check-ins using]

package xfer

import "testing"

// The gate must classify cards exactly as zit's tokenizer does: an
// indented push/login card is honored by the backend, so missing it is
// a full auth bypass (audit CRITICAL, 2026-08-16).
func TestScanRequestWhitespaceCards(t *testing.T) {
	for _, tc := range []struct {
		name string
		body string
		push bool
		user string
	}{
		{"plain push", "pragma x\npush SRV PRJ\nfile H 1\n", true, ""},
		{"space-indented push", "pragma x\n push SRV PRJ\nfile H 1\n", true, ""},
		{"tab-indented push", "pragma x\n\tpush SRV PRJ\n", true, ""},
		{"VT-indented push", "pragma x\n\x0bpush SRV PRJ\n", true, ""},
		{"FF-indented push", "pragma x\n\x0cpush SRV PRJ\n", true, ""},
		{"CR-indented push", "pragma x\n\rpush SRV PRJ\n", true, ""},
		{"multi-space run", "pragma x\n   push   SRV   PRJ\n", true, ""},
		{"indented login", "pragma x\n login dan aaa bbb\npush SRV PRJ\n", true, "dan"},
		{"malformed push arity still gates", "pragma x\n push SRV\n", true, ""},
		{"pull only, no push", "pragma x\npull SRV PRJ\n", false, ""},
	} {
		t.Run(tc.name, func(t *testing.T) {
			pr := scanRequest([]byte(tc.body))
			if pr.hasPush != tc.push {
				t.Fatalf("hasPush=%v, want %v", pr.hasPush, tc.push)
			}
			if pr.user != tc.user {
				t.Fatalf("user=%q, want %q", pr.user, tc.user)
			}
		})
	}
	// The project code must still be extracted from an indented card.
	if pr := scanRequest([]byte("pragma x\n push SRV PROJ123\n")); pr.projectCode != "PROJ123" {
		t.Fatalf("indented push projectCode=%q", pr.projectCode)
	}
}