Skip to content

Fix content-only static artifact boundary - #862

Merged
chubes4 merged 1 commit into
mainfrom
security/issue-853-static-site-importer
Aug 6, 2026
Merged

Fix content-only static artifact boundary#862
chubes4 merged 1 commit into
mainfrom
security/issue-853-static-site-importer

Conversation

@chubes4

@chubes4 chubes4 commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

Fixes #853

Summary

  • Add an explicit allowlist for untrusted static artifact files and reject server-side code markers before compilation.
  • Revalidate compiler companion payloads before scaffolding, writing, or activation; companion assets and render templates are content-only.
  • Generate render.php from SSI-owned literal-output code, preserving static dynamic-block registration while preventing source PHP execution.

Tests

  • npm test (51 passed; WordPress-runtime, browser-WP-Codebox, and operator-only suites skipped by manifest without their configured runtime env)
  • npm run test:companion-plugin
  • composer validate --no-check-publish

Migration / Compatibility

Existing compiler payloads using PHP render templates, PHP companion assets, or schema-less companion payloads now fail closed. Migrate server-side behavior to native blocks/data bindings or client-side JavaScript; static markup remains supported in generated dynamic blocks.

AI Assistance

OpenAI GPT-5.6 Sol via OpenCode implemented the content-only intake and companion-plugin boundary, updated tests and documentation, and ran the listed verification. Chris Huber remains responsible for every line.

AI: OpenAI GPT-5.6 Sol via OpenCode implemented the content-only intake and companion-plugin boundary with adversarial regression coverage.
@chubes4
chubes4 merged commit 700fcad into main Aug 6, 2026
1 of 6 checks passed
@chubes4
chubes4 deleted the security/issue-853-static-site-importer branch August 6, 2026 19:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Make static artifact intake content-only by default

1 participant