Skip to content

fix(reliability): bound HTML-to-Markdown input before parser materialization #169

Description

@seonghobae

Current authoritative state

Protected shipped truth is exact main@3b38ead2d00f44eb578d0689087b9293b3dabe1e. The original unbounded htmlToMarkdown() parser-materialization defect is repaired on consolidated Draft PR #176 / branch fix/public-markdown-resource-options-175, which is the sole active writer for this overlapping Markdown reliability surface and explicitly Closes #169. At this issue synchronization, the exact Draft head is 68aa1ed4f08e2c65826dccb02ca8f3e2da3a9407; live PR/head and independently resolved protected main remain lifecycle authority.

Implemented active-PR contract

HtmlToMarkdownOptions.maxHtmlBytes accepts an optional positive safe integer, defaults to 16 MiB, and rejects configured values above the 64 MiB hard maximum. Accepted primitive-string input is checked first by a UTF-16 code-unit lower bound and then, where necessary, by exact UTF-8 byte length before browser template or browserless Turndown parser materialization. Oversized input fails through the payload-redacted HtmlToMarkdownResourceError / input_too_large contract. Non-string runtime input uses the stable invalid_input category before caller property access, encoding, DOM materialization, or parser work.

The public runtime option bag is also fail-closed: ordinary/null-prototype enumerable data properties are accepted for the supported keys; accessor-backed properties are rejected without invoking their getters; unknown/symbol/non-enumerable properties, malformed values, exotic prototypes, and hostile reflection failures normalize to invalid_configuration. JavaScript Proxy meta-object reflection may itself execute Proxy traps, so no contrary no-caller-code claim is made; private thrown values are normalized/redacted.

Accepted includeImageAlt, safe-link, strict inline-raster, Markdown output, browserless package, SSR/browser/Office, and deterministic standalone behavior remain preserved. This adds no transport, persistence, authorization, tenancy, credentials, network, model/provider, deployment, migration, retention, durable-audit, or collaboration authority.

Verification / integration boundary

#176 contains the executable parser-allocation, runtime-option-bag, non-string-input, exact-boundary, UTF-8-accounting, package-consumer and coverage tests for this contract. Current exact-head repository evidence must be read live and predecessor evidence must not transfer; the PR remains Draft and unmerged.

Keep this issue open until #176 integrates into protected main under then-live governance. While #118 owns exact protected v0.6.0 publication/provenance acceptance, do not advance #176 into protected main, force-push/destructively rebase it, revive superseded resource-bound writers, weaken gates, or represent this active-PR behavior as shipped.

Metadata

Metadata

Assignees

No one assigned

    Labels

    area: apiAPI, protocol, event, or external contractarea: authAuthentication, authorization, identity, or tenant isolationarea: ci-cdCI, GitHub Actions, checks, release, or supply chainarea: securitySecurity boundary, hardening, or vulnerability preventionpriority: mediumNormal-priority or P2 workstatus: triagedOpen issue has an organization taxonomy assignmenttype: bugDefect or incorrect behavior

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions