llm-security-commons

History

Kjell Tore Guttormsen 6f79a6ea57 fix(lexicon,docs): the script-tag row reversed — commons is now the sole diverger llm-security commit 90f576f (2026-08-10) dropped the closing-</script>-tag requirement from hybrid-xss:script-tag, matching what the guard has always had. Both now agree in shape (no closing tag required), still not byte-identical ([^><] vs [^>]). Commons' own extracted pattern is unchanged under behaviour-preservation, so it is the only one of the three still requiring a closing tag — the opposite of what the divergence doc said when it was written. injection-lexicon.json gains source_fidelity.post_extraction_drift: the existing 83/83-at-b0de0ca claim is untouched (extraction-commit fidelity never decays), and the new 82/83-at-b1ba1fb count carries its own commit and date so it doesn't read as a bare, decaying "vs HEAD" claim. Verified directly against both upstream trees this session, not relayed: llm-security's public remote re-fetched to b1ba1fb, guard read at HEAD 0dce50f.	2026-08-11 12:45:44 +02:00
..
injection-lexicon.json	fix(lexicon,docs): the script-tag row reversed — commons is now the sole diverger	2026-08-11 12:45:44 +02:00

Kjell Tore Guttormsen 6f79a6ea57 fix(lexicon,docs): the script-tag row reversed — commons is now the sole diverger

llm-security commit 90f576f (2026-08-10) dropped the closing-</script>-tag
requirement from hybrid-xss:script-tag, matching what the guard has always had.
Both now agree in shape (no closing tag required), still not byte-identical
([^><] vs [^>]). Commons' own extracted pattern is unchanged under
behaviour-preservation, so it is the only one of the three still requiring a
closing tag — the opposite of what the divergence doc said when it was written.

injection-lexicon.json gains source_fidelity.post_extraction_drift: the
existing 83/83-at-b0de0ca claim is untouched (extraction-commit fidelity never
decays), and the new 82/83-at-b1ba1fb count carries its own commit and date so
it doesn't read as a bare, decaying "vs HEAD" claim.

Verified directly against both upstream trees this session, not relayed:
llm-security's public remote re-fetched to b1ba1fb, guard read at HEAD 0dce50f.

2026-08-11 12:45:44 +02:00

injection-lexicon.json

fix(lexicon,docs): the script-tag row reversed — commons is now the sole diverger

2026-08-11 12:45:44 +02:00