Kjell Tore Guttormsen
b6417414c8
New fixture class for the D4 step-0 split (commons-owned; delivered into catalog's corpus/runner). A nav-golden case is bundle in / expected-read- context out — the shape that expresses "two conformant implementations MUST produce an identical read-context" (method-spec §3 Step 1). - nav-golden-hierarchy/ (positive): depth-first first-seen order, both link forms (/ = bundle root vs relative), one segment per level, resolved-path dedup, cycle termination, recursive verdict exclusion, missing-index binds root alone, flat render. - nav-golden-escape/ (negative, gate must go red): .. escapes and a /etc/passwd root-relative trap; conformant returns only valid.md. Both expected-read-context.md verified byte-for-byte against a conformant navigator implementing §3 Step 1; the negative case verified to diverge under a naive navigator. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VUCuNNvnCkayuUDy2WFgeU
27 lines
1.6 KiB
Markdown
27 lines
1.6 KiB
Markdown
# nav-golden-escape — negative navigation golden (the gate must be able to go red)
|
|
|
|
Per catalog's requirement that step 0's gate must be able to **fail** (a gate that can
|
|
only pass proves nothing), this negative case makes a conformant navigator and a naive one
|
|
**provably diverge**. It is the counterpart to `nav-golden-hierarchy` (the positive case).
|
|
|
|
`bundle/index.md` links one valid sibling and three escaping / trap targets:
|
|
|
|
| Link | Class | Conformant outcome |
|
|
|---|---|---|
|
|
| `valid.md` | in-bundle | returned |
|
|
| `../SHOULD-NOT-BE-READ.md` | `..` escape (the decoy really exists, one level up) | skipped; decoy never read |
|
|
| `../../../../etc/passwd` | deep `..` escape | skipped |
|
|
| `/etc/passwd` | root-relative **trap** | skipped |
|
|
|
|
The trap is the load-bearing one. Under the ratified rule, a leading `/` denotes the
|
|
**bundle root**, so `/etc/passwd` resolves to `{bundle}/etc/passwd` (no such file → skip),
|
|
NOT the filesystem path. A naive implementation that reads `/` as filesystem-absolute opens
|
|
the real `/etc/passwd` — a path-traversal breach. This case fails for any implementation
|
|
that raises, reads the decoy, or leaks `/etc/passwd` content; it passes only when the
|
|
read-context is exactly `valid.md`.
|
|
|
|
The malformed-target sub-class (an embedded null byte, other invalid path components) is
|
|
covered by the method-spec §11 **Navigation boundary** seam as a unit test — a literal null
|
|
byte does not belong in a committed text fixture. (See the relocated finding
|
|
`docs/plan/2026-07-20-funn-portfolio-optimiser-nullbyte.local.md` for the concrete
|
|
null-byte reproduction that motivates the seam.)
|