| Both sides previous revisionPrevious revision | |
| provenance:security:web_vulnerabilities [2026/09/17 07:24] – Markup rendering sweep: wrap escapes, CLI flag typography, and heading quotes. Authored by Claude. karel.kubicek.claude | provenance:security:web_vulnerabilities [2026/09/17 08:14] (current) – Qualify root Security links; Authored by Claude karel.kubicek.claude |
|---|
| * Review models requested by this sitting: **GPT 5.6 Luna medium** (''gpt-5.6-luna-medium'') for the three focused passes **and** the generic pass, instead of the spec's sonnet/fable split. Logged here so a later reader does not assume the default mix. | * Review models requested by this sitting: **GPT 5.6 Luna medium** (''gpt-5.6-luna-medium'') for the three focused passes **and** the generic pass, instead of the spec's sonnet/fable split. Logged here so a later reader does not assume the default mix. |
| * Corpus at run time: 5,859 extracted papers, 2010–2026, CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P. Read-only inputs under ''/workspace/publications_dataset/data/''. | * Corpus at run time: 5,859 extracted papers, 2010–2026, CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P. Read-only inputs under ''/workspace/publications_dataset/data/''. |
| * Read first: the wiki-measuretheweb spec (audience, currency, 5,859-paper corpus, provenance page, start link, bibtex), [[literature:corpus]], [[security]], [[practices:ethics]], [[practices:notifying_websites]], [[privacy:javascript]], [[programming:crawler:foxhound]], [[programming:interaction]], live ''start'' (already promised [[Security:Web vulnerabilities]]). | * Read first: the wiki-measuretheweb spec (audience, currency, 5,859-paper corpus, provenance page, start link, bibtex), [[literature:corpus]], [[:security]], [[practices:ethics]], [[practices:notifying_websites]], [[privacy:javascript]], [[programming:crawler:foxhound]], [[programming:interaction]], live ''start'' (already promised [[Security:Web vulnerabilities]]). |
| * Target pages had no revision (''core.getPageInfo'' "does not exist"). ''dw.mjs pages'' does not list ''provenance:''. ''?do=export_raw'' on a missing page returns an HTML error document — that is not an existence test. This is a creation, not an extension. | * Target pages had no revision (''core.getPageInfo'' "does not exist"). ''dw.mjs pages'' does not list ''provenance:''. ''?do=export_raw'' on a missing page returns an HTML error document — that is not an existence test. This is a creation, not an extension. |
| * Live ''start'' (rev 1787836787) already links the child; this sitting does not edit ''start''. Live ''security'' (rev 1787835259) still says all five children are red links — WRAP updated to name this child as written. Live [[Security:VirusTotal]] does **not** exist; the local draft of that page is not this item and is not claimed live. | * Live ''start'' (rev 1787836787) already links the child; this sitting does not edit ''start''. Live ''security'' (rev 1787835259) still says all five children are red links — WRAP updated to name this child as written. Live [[Security:VirusTotal]] does **not** exist; the local draft of that page is not this item and is not claimed live. |
| | [[privacy:javascript]] | script behaviour without an exploitability claim | "is this live origin exploitable" | | | [[privacy:javascript]] | script behaviour without an exploitability claim | "is this live origin exploitable" | |
| | [[security:headers]] | CSP/HSTS as crawlable artefacts (still unwritten) | payload-executed XSS | | | [[security:headers]] | CSP/HSTS as crawlable artefacts (still unwritten) | payload-executed XSS | |
| | [[security]] | schema populations for five children, including the 880 / 209 / 99 | the hand map of the 99 | | | [[:security]] | schema populations for five children, including the 880 / 209 / 99 | the hand map of the 99 | |
| |
| A reasonable person might have treated the 99 as the population. That is the mistake the parent cell already forbids. Another might have written a nuclei/ZAP tool page; full-text union of nuclei/nikto/w3af/openvas is **24** papers — residue here, not a page (already rejected on [[security]]). | A reasonable person might have treated the 99 as the population. That is the mistake the parent cell already forbids. Another might have written a nuclei/ZAP tool page; full-text union of nuclei/nikto/w3af/openvas is **24** papers — residue here, not a page (already rejected on [[:security]]). |
| |
| ===== Population and queries ===== | ===== Population and queries ===== |
| * OWASP Top 10 **2017 A7** as the current XSS letter — superseded 2021 (A03) and 2025 (A05). | * OWASP Top 10 **2017 A7** as the current XSS letter — superseded 2021 (A03) and 2025 (A05). |
| * Chromium XSS Auditor as a 2026 defence to evaluate against. | * Chromium XSS Auditor as a 2026 defence to evaluate against. |
| * A nuclei / nikto / w3af / OpenVAS scanner-tool page — 24 full-text hits, already rejected on [[security]]. | * A nuclei / nikto / w3af / OpenVAS scanner-tool page — 24 full-text hits, already rejected on [[:security]]. |
| * MDN / textbook explanations of ''X-Frame-Options'' to pad the clickjacking hole. | * MDN / textbook explanations of ''X-Frame-Options'' to pad the clickjacking hole. |
| * SEO "top web vulnerabilities 2026" listicles. | * SEO "top web vulnerabilities 2026" listicles. |
| |
| Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with ''check_wrap.mjs'' and ''check_typography.mjs''. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving. | Mechanical rendering repair only: a fresh live raw/XHTML export of 188 pages was checked with ''check_wrap.mjs'' and ''check_typography.mjs''. Affected plugin tags, CLI flags and heading markup were repaired; no figures or substantive prose were changed. The resulting source and rendered DOM were re-checked after saving. |
| | |
| | ===== Link-hygiene sweep, 2026-09-17 ===== |
| | |
| | The fresh rendered-DOM sweep found four bare ''security'' links resolving to ''provenance:security:security''. They are now root-anchored; the post-save DOM was re-checked for red links. No figures or citations changed. |
| |
