open/llm-ingestion-pipeline-security
1
0
Fork 0
Code Issues Releases 4 Activity
4 releases 14 tags
  • v0.7.0 be9759b4b3

    v0.7.0 Stable

    ktg released this 2026-08-13 18:22:29 +00:00 | 23 commits to main since this release

    No known key found for this signature in database

    Added — active:raw-html-link, a click-required carrier class for raw HTML

    Raw HTML graded on activity alone: every active tag was HIGH. So the same URL
    was LOW as [t](https://example.com/guide) and HIGH as
    <a href="https://example.com/guide"> — an asymmetry produced by syntax, not by
    affordance. Following an anchor needs a human, exactly like the markdown inline
    link that has been MEDIUM since 0.3.1.

    <a> and <area> now report as active:raw-html-link at MEDIUM. Everything
    a renderer fetches or executes unattended keeps active:raw-html at HIGH, and the
    event-handler test runs first, so <a onclick=...> is graded as the
    execute-class carrier it is rather than downgraded with the anchors.

    The URL-attribute branch deliberately stays on the HIGH side: a name outside the
    active set has unknown rendering, and href is not the only URL attribute it may
    carry. Grading <Card src="..."> as a link would be reasoning, not measurement.

    This is a new label, and labels are a contract surface consumers pin against.
    A document that previously produced one active:raw-html finding may now produce
    two findings, one per carrier class.

    Changed — a tag whose whole affordance is a URL it does not carry is inert

    </a>, <Frame>, <video /> and <img alt="..."> without src were active by
    name while naming no target at all. This is <base />'s argument from 0.6.0 —
    "attribute-less, therefore no affordance in any renderer" — applied to the rest of
    the name branch. The test is for the URL attribute's presence, not for a
    readable value: a value the parser cannot resolve keeps the tag active, mirroring
    the fail-secure gap _url_attr_is_external already leaves open.

    Every other member of the active name set does something a URL cannot describe —
    <script> executes its body, <style> restyles, <form> submits — and stays
    active with no attributes at all.

    Changed — active_tag_class is the classification point; is_active_tag wraps it

    docs/rawhtml-census.py measures candidates by patching this symbol, and a
    boolean could only express a narrowing, never a regrade. Left as a boolean, every
    carrier candidate would have measured equal to PRODUCTION — silently, and in the
    direction that reads as "no change helps".

    Measured

    docs/rawhtml-census.py, three populations, each at one corpus state and each
    against its own denominator — the two wiki corpora share content and are never
    summed. Documents that stop being fail_secure under PRESET_USER_UPLOAD, from
    0.6.0 as shipped to 0.7.0, with the ceiling being the raw-HTML detector switched
    off entirely:

    population documents 0.6.0 → 0.7.0 ceiling share of achievable
    reference-corpus 389 54 → 53 53 1 of 1
    vendor-harvest 187 62 → 20 18 42 of 44 (95%)
    generated-notes 552 59 → 15 13 44 of 46 (96%)

    Neither change alone is worth shipping, and the census is why they went out
    together.     Alone, the split frees 8 documents in each wiki corpus and the
    narrowing 21 and 23 — but 8+21 measures 42 and 8+23 measures 44. The residual is
    13 documents in both corpora: the narrowing strips a document's </a> and
    <Frame>, and what is left is the <a href=...> the split grades down, so each
    change alone leaves the document blocked by the other's residue.

    Tightening, measured: 0 documents on both trust tiers, in all three
    populations.     That zero is empirical and thinner than it looks — the split
    alone tightens 13 documents on the trusted tier in vendor-harvest and 14 in
    generated-notes, and the narrowing cancels each one. See docs/LIMITATIONS.md
    for why it must not be read as "cannot happen".

    The PRODUCTION (as shipped) row matched C1 + D (0.7.0) field for field in
    every population, which is the check that the census and the shipped predicate
    have not drifted apart.

    Known behaviour change

    count drops on documents containing </a>. Through 0.6.1 an end tag was
    active by name, so count ran roughly 1.6× the opening-tag total and a start/end
    pair counted 2. It is now the opening-tag total. The field's meaning did not
    change and the finding count is unaffected — the class still collapses to one
    finding per class per document.

    Downloads