Source: v1.0.4-rc1 RRI @fa97b34 (adversarial persona). Evidence: vm2-adversarial/bugs.ndjson.
XSS partial sanitization: <script> tags are stripped, but the inner text leaks into the chronicle rendered as a player action. Incomplete sanitization of player-move input → an injection / action-spoofing surface in the player-visible log. Sanitize/escape player move text end-to-end (strip tag bodies, not just tags; render as text, never markup) on the /move → chronicle path. Sprint 1 (security).
Source: v1.0.4-rc1 RRI @
fa97b34(adversarial persona). Evidence:vm2-adversarial/bugs.ndjson.XSS partial sanitization:
<script>tags are stripped, but the inner text leaks into the chronicle rendered as a player action. Incomplete sanitization of player-move input → an injection / action-spoofing surface in the player-visible log. Sanitize/escape player move text end-to-end (strip tag bodies, not just tags; render as text, never markup) on the/move→ chronicle path. Sprint 1 (security).