59 lines
2.0 KiB
Markdown
59 lines
2.0 KiB
Markdown
---
|
|
id: core-fix-display-log-forging
|
|
name: Control-char-safe Display for the consumer-string error variants (review 004 item 14)
|
|
status: pending
|
|
depends_on: []
|
|
scope: single
|
|
risk: low
|
|
impact: isolated
|
|
level: implementation
|
|
tags: [review-004-fixes, core, errors]
|
|
---
|
|
|
|
## Description
|
|
|
|
The core error `Display` log-forging risk, per
|
|
`docs/reviews/004-pre-release-general-review.md` §"Findings recorded,
|
|
not fixed" item 14: `InvalidName`/`ReservedName`/`InvalidSpec`
|
|
interpolate raw consumer strings into `Display`; control characters
|
|
can forge log lines in naive consumers. Typical-idiom risk, low — but
|
|
the fix is small and real.
|
|
|
|
Fix: escape/sanitize the interpolated payload in the three variants'
|
|
`Display` arms (e.g. `char::escape_debug` or a control-char filter) so
|
|
the rendered message cannot carry raw newlines/control bytes from
|
|
consumer input. The error taxonomy itself is untouched — variants,
|
|
kinds, and match sites stay exactly as pinned (ADR-008 §5); only the
|
|
rendered text's hygiene changes.
|
|
|
|
While there: grep the `Error` enum's other `Display` arms for the same
|
|
consumer-string interpolation class; if any other variant carries it,
|
|
include it in the same fix (and say so in Notes).
|
|
|
|
## Acceptance Criteria
|
|
|
|
- [ ] The three variants' `Display` renders consumer strings
|
|
control-char-safe — pinned by test (a name/spec carrying `\n`
|
|
and control bytes renders without any raw control byte)
|
|
- [ ] The error taxonomy unchanged (variants, kinds, match sites);
|
|
existing error/validation tests green unchanged
|
|
- [ ] Any additional same-class `Display` arms included (or the
|
|
absence recorded in Notes)
|
|
- [ ] `cargo test -p alkstore`, clippy `-D warnings`, fmt clean; doc
|
|
gate green
|
|
|
|
## References
|
|
|
|
- docs/reviews/004-pre-release-general-review.md §"Findings recorded,
|
|
not fixed" item 14 (the finding)
|
|
- docs/architecture/decisions/008-*.md §5 (the error taxonomy — the
|
|
part that must not change)
|
|
- alkstore/src/errors (the `Display` arms)
|
|
|
|
## Notes
|
|
|
|
> To be filled by implementation agent
|
|
|
|
## Summary
|
|
|
|
> To be filled on completion |