Skip to content

v3.1.6

v3.1.6: fix(c2pa): hard binding HTML-stripping fallback for text verification
@erik-sv erik-sv tagged this 22 Apr 01:59 
Producers like WordPress may hash plain text (HTML stripped) but embed
the C2PA wrapper into the original HTML content. When the verifier
receives HTML-wrapped text, the hard binding hash mismatches because
the hash covers plain text while the verified content contains HTML tags.

Add an HTML-stripping fallback in hard binding verification: if the
initial hash doesn't match, strip HTML tags, locate the wrapper in the
stripped text, and recompute the hash. This handles the WordPress
content provenance flow where wp_strip_all_tags() produces the signed
content but the wrapper is appended to post_content.
Assets 2
Loading