amadan
carlos / todomvc-bakeoff Public
docs(nim): STATUS after review round 2, live at 290dbb4
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
1 file changed,
+25
−6
apps/nim/STATUS.md+25 −6
diff --git a/apps/nim/STATUS.md b/apps/nim/STATUS.md| index f705d36..b5b8208 100644 |
| --- a/apps/nim/STATUS.md |
| +++ b/apps/nim/STATUS.md |
| @@ -1,16 +1,16 @@ |
| -LIVE https://todo-nim.bfj.oncarlos.com 6aa1f35 |
| +LIVE https://todo-nim.bfj.oncarlos.com 290dbb4 |
| ## Where it stands |
| -- Deployed `6aa1f35` (the review fixes) to `todo-nim` on account `bfj`, |
| - channel `edge`. `carlos deploy` confirmed it through the `/api/version` |
| - build probe. The first deploy was `df803f7`. |
| +- Deployed `290dbb4` (the second review round's fix) to `todo-nim` on |
| + account `bfj`, channel `edge`. `carlos deploy` confirmed it through the |
| + `/api/version` build probe. Earlier deploys: `df803f7`, then `6aa1f35`. |
| - Shared behaviour suite: **67 passed, 3 skipped** both locally |
| (`dist/app --listen`) and against |
| `https://todo-nim.bfj.oncarlos.com`. The skips are the suite's own: blur |
| and Escape editing with JavaScript off, and the screenshot test with |
| JavaScript off. |
| -- `make test`: 16 unit tests pass (store scoping, filters, toggle-all, |
| +- `make test`: 17 unit tests pass (store scoping, filters, toggle-all, |
| Unicode and 10,000-character titles, Unicode-whitespace trimming, migrations, cookies, 303s, 403 on |
| a foreign Origin, 404 on a foreign id, the edit view, fragments, static |
| files). |
| @@ -35,7 +35,26 @@ LIVE https://todo-nim.bfj.oncarlos.com 6aa1f35 |
| - The README and AGENTS.md prose didn't go through a copy review. This |
| session ran unattended, and that review needs a person. |
| -## Review round |
| +## Review round 2 |
| + |
| +The one finding is fixed in `290dbb4`: |
| + |
| +1. **Invalid UTF-8 in titles (security).** `title=%80` made |
| + `unicode.strip` index out of bounds. The `IndexDefect` isn't a |
| + `CatchableError`, so it got past the handler and stopped the server. |
| + Now `action` runs `unicode.validateUtf8` on the decoded title before |
| + anything else touches it, and answers **400** if it isn't valid. That |
| + check is bounds-safe. Browsers always send UTF-8, so a real visitor |
| + never hits this. A unit test covers truncated 2-, 3- and 4-byte |
| + sequences and stray bytes for both add and edit, and the list is |
| + unchanged afterwards. Before the fix, `title=%80` killed the local |
| + binary. After it, the binary and the live host both answer 400 and |
| + keep serving. |
| + |
| +After the fix the shared suite gave 67 passed and 3 skipped both locally |
| +and against the live host, and the boot check passed. |
| + |
| +## Review round 1 |
| All four findings are fixed in `6aa1f35`: |