carlos / todomvc-bakeoff Public

docs(zig): STATUS — malformed UTF-8 abort fixed, live at e5042a9

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Paul Campbell pushed by claude 1 day ago 73268e0c381bd98eae62f12db9971329330d83ee parent e5bb4d4

1 file changed, +22 −2

diff --git a/apps/zig/STATUS.md b/apps/zig/STATUS.md

index 5cfd7fd..e5e83c2 100644

--- a/apps/zig/STATUS.md

+++ b/apps/zig/STATUS.md

@@ -1,9 +1,9 @@

-LIVE https://todo-zig.bfj.oncarlos.com 576c3b8

+LIVE https://todo-zig.bfj.oncarlos.com e5042a9

## What's live

- `todo-zig` on account `bfj`, one instance on channel `edge`, build probe

- `/api/version`. The deployed version is `576c3b8`; `/api/version` and

+ `/api/version`. The deployed version is `e5042a9`; `/api/version` and

`X-Carlos-Version` both report it.

- The shared behaviour suite passed locally (67 passed, 3 skipped) and

again against [https://todo-zig.bfj.oncarlos.com](https://todo-zig.bfj.oncarlos.com)

@@ -58,3 +58,23 @@ The second review request listed no findings, so the code is unchanged

and nothing was redeployed: rebuilding and redeploying the same commit

would change nothing. The live site still reports `576c3b8`, and the

shared suite run against it again passed (67 passed, 3 skipped).

+## Third review round (e5042a9)

+1. **[security] Malformed UTF-8 in a title aborted the server.** Fixed.

+ The backward scan in `trimTitle` (`src/app.zig`) passed every byte

+ after a lead byte to `std.unicode.utf8Decode`. That function asserts

+ it gets exactly one sequence, so `title=a%80%80%80%80` reached

+ `unreachable` and the ReleaseSafe build aborted. I reproduced the

+ abort on the previous binary. The scan now checks that the lead

+ byte's sequence length matches the bytes found before it decodes;

+ anything else is treated as non-whitespace and ends the trim, so a

+ malformed title is stored as sent, untrimmed at that end.

+ Regression cases are in the `trimTitle` unit test.

+ Verified: locally the four malformed payloads answer 303 and

+ `/healthz` stays 200, and the live site answers 303 to the reported

+ payload. The shared suite passed locally and against the live site

+ (67 passed, 3 skipped each time), and `boot-check.sh` passed on the

+ new arm64 binary.

+No findings from this round were left unfixed.