diff options
| author | Lukasz Kasprzak <lukas@labunix.xyz> | 2026-09-14 20:34:21 +0200 |
|---|---|---|
| committer | Lukasz Kasprzak <lukas@labunix.xyz> | 2026-09-14 20:34:21 +0200 |
| commit | 3890b27b5a68f5521f4f0a234cebf528744356ee (patch) | |
| tree | b0cf06133305c4e288a9471649ac65ff4a7a5872 | |
| parent | 7b2c020a08b3b9f291ba14c71b5fbb5693b6cf6f (diff) | |
| download | krino-3890b27b5a68f5521f4f0a234cebf528744356ee.tar.gz krino-3890b27b5a68f5521f4f0a234cebf528744356ee.zip | |
krino: 0.0.7 — hardening: terminal-safe names, placeholder and swap guards, undo of chains, fuzz and property tests
| -rw-r--r-- | CHANGELOG.md | 19 |
1 files changed, 17 insertions, 2 deletions
diff --git a/CHANGELOG.md b/CHANGELOG.md index 10c49ae..b0296f8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,12 +2,25 @@ ## Unreleased +## 0.0.7 — 2026-09-14 + +Security and correctness hardening, from a threat model (spec §15.1) and the +tests that hold it. + +- File names, paths and tool messages can no longer control the terminal: + control characters, bidirectional controls and invalid UTF-8 are printed + as escapes (`\x1b`, `\u202e`) everywhere krino prints them. +- A placeholder can no longer rename a file to "", "." or "..", or add a + ".." to a destination; such a step is skipped with a reason. +- A file swapped between planning and applying - for a symlink, or for + another file with the same size and modification time - is not acted on. +- Undo refuses a trash entry name that is not a plain name inside the + Trash, and a trashinfo whose path is not absolute. - Undo reverses a file its run renamed and then moved, moved twice, or moved and then sent to the Trash. Before, undo judged the first step against the disk as it is now, found its destination empty (the later step had moved the file on) and refused the whole file as "missing". Found by the new generated apply-and-undo test. - - Folding maps the capital sharp s (ẞ) to "SS", as the other capitals already were: "STRAẞE" in a document now matches the keyword "straße". - Folding replaces invalid UTF-8 with U+FFFD first, so a stray invalid byte @@ -16,12 +29,14 @@ reason, instead of reporting a broken template. - The keyword cache is also discarded when normalisation changes, so answers cached before these fixes are recomputed once. - - Builds need Go 1.25 or newer and use the Go 1.26.8 toolchain, which an older `go` downloads itself. `golang.org/x/text` is updated to v0.41.0. This fixes an infinite loop a crafted file's text could cause (GO-2026-5970) and, through the toolchain, the XML nesting guard (GO-2026-6088) and the `os/exec` and `os` fixes govulncheck reported. +- Tests: fuzz targets for every decoder of outside data (`make fuzz`), a + generated apply-and-undo round trip (`KRINO_PROPERTY_RUNS`), + enum-completeness tests, `make race` and `make vulncheck`. ## 0.0.6 — 2026-09-14 |