wt
f556fc0deb
Changes: Preserve incomplete work and blocker metadata for S00-003. This checkpoint does not mark implementation accepted. Validation: Session ended with status blocked. Blocker: S00-003 cannot attest parser limits: Stanza 12.22.1 exposes no resource bounds and its persistent WebSocket parser accepts large/deep XML and reassembles incomplete documents across separate input messages. Task: S00-003 Agent: auto-protocol-902594b44429 Role: protocol Action: claim Status: blocked Task title: Проверить XMPP WSS/auth библиотеку
23 lines
1.1 KiB
Markdown
23 lines
1.1 KiB
Markdown
# Blocker S00-018
|
|
|
|
- Original task: S00-003
|
|
- Root task: S00-003
|
|
- Reporter: auto-protocol-902594b44429
|
|
- Role: protocol
|
|
- Original owner: auto-protocol-902594b44429
|
|
- Waits for user/external condition: False
|
|
|
|
## Cause
|
|
|
|
S00-003 cannot attest parser limits: Stanza 12.22.1 exposes no resource bounds and its persistent WebSocket parser accepts large/deep XML and reassembles incomplete documents across separate input messages.
|
|
|
|
## One remediation outcome
|
|
|
|
One isolated runnable and independently reviewed ingress experiment enforces explicit finite XML resource limits and standalone text XML per WebSocket message before unsafe accumulation/import, through a supported library integration path.
|
|
|
|
## Evidence / reproduction
|
|
|
|
Run the pinned Node command in state/evidence/S00-003-auto-protocol-902594b44429.md: parser-probe/reproduce.mjs exits 0 after observing acceptance of a 1 MiB body, depth 256, and unfinished XML retained across 18 writes. Inspect stanza/transports/websocket.js and jxt/StreamParser.d.ts for absent per-message completeness/resource-limit enforcement.
|
|
|
|
The reporting agent must stop now. A new agent implements only S00-018.
|