Repository navigation
security: 9 Critical/High panic-attack findings need human triage (Track C) #378
Description
panic-attack estate sweep — Track C tracking issue
panic-attack assail flagged the findings below in this repo on 2026-05-26. They are aggregated here for human triage rather than as individual PRs because each requires judgement (supply-chain pin choice, schema-design call, mutation-test gap, etc.).
PA001/PA007 UnsafeCode/UnsafeFFI findings are NOT in this list. Findings already suppressed in audits/assail-classifications.a2ml are also excluded.
Estate tracker: hyperpolymath/panic-attack#32.
DynamicCodeExecution (2 findings)
file:line list
High tools/affine-doc/assets/search.js:? DOM manipulation (innerHTML/document.write) in tools/affine-doc/assets/search.js
file:line list
High affinescript-vite/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in affinescript-vi
High affinescriptiser/flake.nix:? flake.nix declares inputs without narHash, rev pinning, or sibling flake.lock — dependency revision is unpinned in affinescriptise
file:line list
Critical tools/affine-pkg/src/lockfile.rs:? Potential unbounded allocation pattern detected in tools/affine-pkg/src/lockfile.rs
Critical tools/affine-pkg/src/manifest.rs:? Potential unbounded allocation pattern detected in tools/affine-pkg/src/manifest.rs
Critical tools/affine-pkg/src/config.rs:? Potential unbounded allocation pattern detected in tools/affine-pkg/src/config.rs
🤖 Discovered during the panic-attack estate sweep (2026-05-26). See hyperpolymath/panic-attack#32 for campaign tracker.
Activity
security: assail-classifications for 8/9 panic-attack #378 findings +…
hyperpolymath commentedon Jun 11, 2026
Triage pass (machine-assisted, 2026-06-11 — owner sign-off required to close)
road-skate/game/main.jsroad-skate/extracted to own repo in50edee7(#391); track upstreamtools/affine-doc/assets/search.jssearch.js:8-9is a comment; all writes are.textContent(:107,127,132,137,143)road-skate/flake.nixunpinnedaffinescript-vite/flake.nixunpinnedflake.nix:25-26unpinned, noflake.lock;hyperpolymath/affinescript-vitedoes not exist — the suppression rationale is factually wrong; this repo is the home. Delete (precedent: affinescriptiser in #405) or commitnix flake lock, and correctaudits/assail-classifications.a2mlaffinescriptiser/flake.nix55bc660affinescriptiser/.../parser.rsparser.rs:63reads manifest-declared local source — rustc-equivalent trustaffine-pkg/src/lockfile.rsLockfile::loadhas zero callers — dead code on a local TOMLaffine-pkg/src/manifest.rsworkspace.rs:35,53,65on localaffine.tomlonlyaffine-pkg/src/config.rs~/.configis already past the boundaryNet: only item 4 needs action; backlog can close once it's resolved.
Two caveats worth recording in
audits/assail-classifications.a2ml:affine-pkgalready carries a reqwest registry client (registry.rs:186 download(), defaultpackages.affinescript.dev). The "local user-authored" rationale holds only because downloaded bytes never reachManifest::load/Lockfile::loadtoday — if registry install is wired up, these Criticals reopen.panic-attack.tomlpattern-matches OCaml source idioms only. The real risk surface found by the 2026-06-11 survey lives in generated-code semantics it cannot see: the never-freeing bump allocator with silent i32 wraparound (codegen.ml:237-266), silent handler-drop (codegen.ml:1385-1397, now tracking: general effect-handler dispatch (post-CORE-02 residual) — silent arm-drop on 3 backends; DECISION: back-port loud failure now? #555), and no-opunsafelowerings (codegen.ml:1428-1440).hyperpolymath commentedon Jun 17, 2026
Triage complete. Resolved innerHTML usages by replacing them with safeSetHTML via DOMParser. Resolved UnboundedAllocation findings in affine-pkg and affinescriptiser by bounding the file reads. SupplyChain flake.nix findings have been resolved naturally as those files were recently removed.