Skip to content

v2.4.1: Adversarial Hardening, Deterministic Chromium Runtime & DoS-Safe Validator

Choose a tag to compare

View all tags
@omid-io omid-io released this 03 Sep 10:28
· 63 commits to main since this release
v2.4.1
cc036e9

v2.4.1: Adversarial Hardening, Deterministic Chromium Runtime & DoS-Safe Validator

This maintenance and security release incorporates deep adversarial hardening from multi-LLM audits (achieving a 9.1 / 10 consensus score across ChatGPT-4o and Grok), closes all known bypass vectors in the pure-Python validator, and introduces multi-viewport layout stabilization in headless Chromium.

🛡️ Security & Closed-World Validator Hardening

  • Closed-World Exploit Prevention: Restricted $schema strictly to the exact root level (path == "$"). Any other property starting with $ (e.g. $injected_exploit or $rogue_key) is rejected immediately.
  • Adversarial Negative Fixtures: Added and automated evals/fixtures/illegal_dollar_property.json, illegal_additional_property.json, and out_of_range_latitude.json.
  • Cycle-Safe $ref Resolution: Implemented recursion depth limit (64) and visited reference set tracking in validate_json_instance() to prevent circular reference DoS crashes.
  • String Constraints: Enforced minLength, maxLength, and regex pattern validations.
  • Strict Domain Bounds: Enforced strict numerical bounds for coordinates (latitude: [-90, 90], longitude: [-180, 180]), financial math (precision_decimals: [0, 8]), and Core Web Vitals budgets.

🌐 Deterministic Chromium Runtime Evals (evals/run_evals.py --browser)

  • Layout & Font Stabilization: Replaced bare domcontentloaded with bounded networkidle (3000ms timeout), document.fonts.ready check, and double requestAnimationFrame before measuring DOM geometry.
  • Multi-Viewport Mobile Overflow (320px & 375px): Audits both standard mobile (375x667) and narrow mobile boundary (320x568). Surgically resolved a 320px horizontal overflow in neobrutalist_creative_store.html.
  • Physical Focus Rings Assertion: Programmatically verified active :focus-visible indicators (outline or box-shadow) on all interactive controls.
  • Prefers-Reduced-Motion Media Emulation: Emulated (prefers-reduced-motion: reduce) in Playwright and verified CSS media responsiveness.
  • Visibility & Accessibility Filtering: Filtered out elements inside [aria-hidden="true"], display: none, or visibility: hidden from interactive target sweeps.

📦 Ecosystem Artifacts

Assets 3
Loading