kyle/boxmaker
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

M5b spec: the plain-URL fetch was marked, not observed

Browse Source 
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This commit is contained in:
kyle
2026-09-26 01:09:18 -07:00
co-authored by Claude Opus 5.5
parent a73c702685
commit 53532e04ff
1 changed files with 3 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/specs/2026-09-26-m5b-hardening.md
+3 -2
View File
@@ -260,7 +260,7 @@ messages and read each post's `metadata` back through the API):
| Posted | Link preview (`embeds`) | Image fetched by the server (`images`) |
|---|---|---|
| a plain URL | yes: a `link` embed, fetched when a client first shows it | |
| a plain URL | marked for a preview (a `link` embed); no card appeared, because `example.com` has no OpenGraph tags, so the fetch itself was not observed | |
| a URL in a code span | none | |
| a URL in a fenced block | none | |
| a Markdown link, `[text](url)` | none: only plain URLs are previewed | |
@@ -269,7 +269,8 @@ messages and read each post's `metadata` back through the API):
| a defanged `hxxps://` URL | none | |
So a code span stops both automatic fetches, and an image is fetched by the server itself, not only
by each client: escaping images matters in every session.
by each client: escaping images matters in every session. The owner's screenshot of the posts
matched the readings; the test posts were then deleted.
`TurnDone` gains `untrusted: bool` (a new field, so its fixture changes). Trusting `loopd`'s own
labels here is sound: this is a defence in depth on presentation, not a trust gate.