Repository navigation
[scanner] Gate proposal: intake text extractors leak non-rendered markup (3rd instance: quoted-attribute '>' in StripTags) #483
Description
Class
Hand-rolled text extractors in pkg/intake leak non-rendered markup content into the idea text users see and the matcher indexes. This is the third instance of the same root cause at a different site, so this is a gate proposal rather than another per-site bug report.
Prior instances (both fixed site-by-site):
- [scanner] intake: StripRTF leaks fonttbl/colortbl/generator header text into extracted idea text #424 —
StripRTFleakedfonttbl/colortbl/generator header text - [scanner] intake: StripTags leaks style, script and comment text from uploaded HTML into idea text #474 —
StripTagsleakedstyle,scriptand comment text (fixed in fix(intake): drop style, script, template and comment text from HTML #476)
New instance (not filed separately):
StripTags(pkg/intake/intake.go:258-289) treats any>as the end of a tag and does not track quoted attribute values.<p title=">leak">hello</p>extracts asleak hello;<a data-x='a>b'>c</a>extracts asb c. The existing test"comment marker inside tag"(intake_test.go:71) shows quoted attributes were considered for<!--but not for>.
Missing gate
There is no CI gate for the class: intake_test.go is a hand-picked golden table, so each new leak is found by reading code after the fact.
Proposed gate (either, maintainers' choice):
- A. Replace the bespoke HTML tokenizer with
golang.org/x/net/html(html.NewTokenizer), which already handles quoted attributes, raw-text elements (script/style), comments andtemplate. The HTML half of the class disappears by construction;StripRTF/DOCX keep their current code. - B. Keep the hand-rolled extractors and add
FuzzStripTags/FuzzStripRTFtargets with a seeded adversarial corpus (quoted>/<, unterminated tags, nestedtemplate, RTF control groups), run inbuild-and-testasgo test -run=^$ -fuzz=Fuzz -fuzztime=20s ./pkg/intake, with an oracle property that no byte sequence appearing only inside a tag/control group appears in the output.
Recommended: A (smaller, standards-compliant, no new CI time).
Decision requested
Accept A, accept B, or decline the gate (in which case the quoted-attribute leak above should be filed and fixed on its own).
Risk: governance
— hive: agent=scanner backend=copilot model=claude-fable-5.1 copilot=1.0.88
Activity
hivecommons-hive commentedon Oct 25, 2026
What to reply
/hive approve: go with the recommendation/hive decision <your instructions>: go ahead, following your instructions/hive help: show these againIf what this issue waited on has been done (a merged fix, or an action taken outside this repository), a maintainer can reply
/fixedto close it as completed; Hive clears its park labels.Only a maintainer with write access can un-park; everything else is ignored. Full command reference: https://github.com/hivecommons/hive/blob/v5/src/docs/maintainer-commands.md.
clubanderson commentedon Oct 26, 2026
/hive decision A - replace the hand-rolled HTML tokenizer with golang.org/x/net/html. Keep the existing golden table as regression tests and add the three leak cases from this issue to it.
hivecommons-hive commentedon Oct 26, 2026
Un-parked by @clubanderson. Decision: A - replace the hand-rolled HTML tokenizer with golang.org/x/net/html. Keep the existing golden table as regression tests and add the three leak cases from this issue to it.
stage/045-needs-decisionis cleared when present andapproved-directionis applied; anyholdlabel is left exactly as it was.hivecommons-hive commentedon Oct 26, 2026
🔒 Claimed by agent
scanner(agent on hive hosted-available-oke-11-placeholder-r05x). The claim lasts 2h0m0s without activity and renews while the work continues. Reply/unclaimto release, or/claimto take it over if you outrank the holder.