Skip to content

Fix frontmatter parsing to preserve YAML privacy tags - #184

Open
levineam wants to merge 1 commit into
mainfrom
codex/propose-fix-for-vulnerability-in-manual-notes
Open

Fix frontmatter parsing to preserve YAML privacy tags#184
levineam wants to merge 1 commit into
mainfrom
codex/propose-fix-for-vulnerability-in-manual-notes

Conversation

@levineam

Copy link
Copy Markdown
Owner

Motivation

  • The frontmatter scalar parser only captured single-line values and JSON-style arrays, which caused YAML block lists like tags:\n - private and unquoted flow lists like tags: [private] to be mis-parsed and allowed private/sensitive notes to be queued.

Description

  • Update parseScalarValue in modules/jarvos-secondbrain/packages/jarvos-secondbrain-notes/src/lib/note-schema.js to collect multiline YAML list items and call stripQuotes on each item.
  • Add a fallback for YAML flow sequences so that unquoted bracketed lists (e.g. tags: [private, reference]) are split and stripQuotes-normalized when JSON.parse fails.
  • Add an end-to-end regression test manual notes apply recognizes private tags in standard YAML lists in modules/jarvos-secondbrain/tests/manual-notes-maintenance.test.js covering block, quoted block, and flow variants and adjust assertions to validate that the automatic queues contain empty entries for private notes.

Testing

  • Ran node --test modules/jarvos-secondbrain/tests/manual-notes-maintenance.test.js and all tests passed (13/13).
  • The new regression confirms report.optimization.sensitiveSkipped increased for the private-tag variants and that gbrain-import-queue.json and memory-wiki-queue.json have empty entries as expected.

Codex Task

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant