mirror of
https://github.com/Matysh/houseplan-card
synced 2026-09-28 19:01:34 +00:00
Codex
2935c293e1
Review CODE-REVIEW-225-r1. M1: urlsplit(url).path was trusted even when the url carried a scheme or an authority, so "https://evil.example/houseplan_files/files/m1/doc.pdf" resolved onto a local file while _looks_internal kept calling it external — the mirror image of the inconsistency this resolver exists to prevent. Only a same-document reference is resolved by its path now. M2: the three mutants the spec described are registered in scripts/mutation-gate.mjs instead of living as a one-off manual run. The traversal entry drops both structural checks at once on purpose: taken one at a time the defence is layered (sanitize_marker_id turns ".." into "misc") and the mutant would be equivalent — established by running it. Issue: #225 User-Visible: no