fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) - #1220

Draft

xarmian wants to merge 27 commits into

mainfrom

fix/bug-2803-json-nul

Commits on Aug 28, 2026

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803)
xarmian
committed
11dec4c
fix(server): follow the NUL refusal into JSON-encoded string fields (BUG-2803)
xarmian
committed
0e7faeb
test(server): build the NUL-bearing timeline fixture through the store (BUG-2803)
xarmian
committed
9c5d1bf
docs(server): correct the timeline comment BUG-2803 falsified (CONVE-23)
xarmian
committed
a1dbdf1
fix(server): scope the nested-NUL walk to JSON-encoded fields (BUG-2803)
xarmian
committed
c369563
fix(server): close the three body doors codex round 3 found (BUG-2803)
xarmian
committed
889519e
fix(server): the escape gate was unsound, and YAML has its own (BUG-2803)
xarmian
committed
baa5bcd
fix(server): multipart text fields and the bundle manifest (BUG-2803)
xarmian
committed
336d978
refactor(server): drop the now-unused escape constant (BUG-2803)
xarmian
committed
c04d16e
fix(server): rune-safe truncation and User-Agent sanitising (BUG-2803)
xarmian
committed
e94e57f
fix(server): narrow the gate, stop refusing natural-shape fields (BUG-2803)
xarmian
committed
73ae902
fix(server): apply the key rule at every level, not once (BUG-2803)
xarmian
committed
78716d6
fix(server): complete the artifact check, make the walk path-aware (BUG-2803)
xarmian
committed
d93a373
fix(server): a regression this branch introduced, and the same trap again (BUG-2803)
xarmian
committed
b32b229
docs(backup): the one case where an export is not importable (BUG-2803)
xarmian
committed
b628c4a
test(server): close two blind spots the tests themselves had (BUG-2803)
xarmian
committed
799a8bf
test(server): the three remaining round-13 gaps (BUG-2803)
xarmian
committed
83831ac
test(server): pin the wiring at every call site, not one (BUG-2803)
xarmian
committed
8bb1acb
fix(server): match wire keys the way the decoder does (BUG-2803)
xarmian
committed
d32e072
fix(server): fold keys the way encoding/json folds them (BUG-2803)
xarmian
committed
b019287

Navigation Menu

Uh oh!

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803) - #1220

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803)#1220
xarmian wants to merge 27 commits into
mainfrom
fix/bug-2803-json-nul

Commits on Aug 28, 2026

fix(server): refuse a decoded NUL in a JSON request body (BUG-2803)

fix(server): follow the NUL refusal into JSON-encoded string fields (BUG-2803)

test(server): build the NUL-bearing timeline fixture through the store (BUG-2803)

docs(server): correct the timeline comment BUG-2803 falsified (CONVE-23)

fix(server): scope the nested-NUL walk to JSON-encoded fields (BUG-2803)

fix(server): close the three body doors codex round 3 found (BUG-2803)

fix(server): the escape gate was unsound, and YAML has its own (BUG-2803)

fix(server): multipart text fields and the bundle manifest (BUG-2803)

refactor(server): drop the now-unused escape constant (BUG-2803)

fix(server): rune-safe truncation and User-Agent sanitising (BUG-2803)

fix(server): narrow the gate, stop refusing natural-shape fields (BUG-2803)

fix(server): apply the key rule at every level, not once (BUG-2803)

fix(server): complete the artifact check, make the walk path-aware (BUG-2803)

fix(server): a regression this branch introduced, and the same trap again (BUG-2803)

docs(backup): the one case where an export is not importable (BUG-2803)

test(server): close two blind spots the tests themselves had (BUG-2803)

test(server): the three remaining round-13 gaps (BUG-2803)

test(server): pin the wiring at every call site, not one (BUG-2803)

fix(server): match wire keys the way the decoder does (BUG-2803)

fix(server): fold keys the way encoding/json folds them (BUG-2803)

Commits on Aug 30, 2026

fix(server): pin that a NUL-bearing manifest refusal keeps the partial workspace (BUG-2803)

docs(server): record the four map-model disagreements as dispositions, and pin them (BUG-2803)

test(server): wire release-note item 10 to the router, with its before-state measured (BUG-2803)

docs(backup): the NUL rule lives in the binary, not the database (BUG-2803, BUG-2813)

docs(server): cite the ruling in house style, not the team-room day counter (BUG-2803)

docs(server): drop a commit count I had already measured as wrong, and stop asserting a cause I borrowed (BUG-2803)

fix(server): sanitise the MCP audit tool_name, and correct three claims wider than their evidence (BUG-2803)