[tsunaminoai]

Readies zigmark for public release and untrusted-input use (PolicyPress), mirroring the pozeiden v0.3.0 hardening run. All findings were confirmed at the source and locked in with a regression suite. CommonMark/GFM conformance is preserved (652/652 + 24/24), and om ci passes (test, fuzz, fmt, wasm).

HTML — XSS

• URL-scheme filtering, default-on. javascript:/vbscript:/file:/non-image data: destinations in links, images, and autolinks render with an empty href/src. Detection normalises the scheme like a browser (leading control/space stripping, single-byte entity decoding so javascript: is caught, tab/newline/CR stripping). A denylist, so made-up-scheme:// and data:image/{png,gif,jpeg,webp} still pass — conformance unchanged.
• Footnote labels escaped — were injected raw into an attribute and element text.
• Opt-in safe mode escapes raw HTML to visible text: html.Options{ .safe = true }, zigmark.renderHtmlWithOptions, the zigmark_render_html_safe C ABI export, and the CLI --safe flag. Default output is byte-identical.

Typst — code injection (compile-time file read)

• Code spans/blocks now emit via raw() with string-literal escaping, so backticks/fences can't break out into executable Typst.
• Frontmatter-derived preamble fields are validated before interpolation (fontsize as a length, colours as hex, strings escaped) with safe fallbacks. The unquoted fontsize was the strongest injection candidate.

DoS / panics

• Parser.max_nesting_depth (128) and Parser.max_input_bytes (16 MiB, 0 = unlimited) turn deeply-nested / oversized input into error.NestingTooDeep / error.InputTooLarge instead of stack overflow / unbounded memory. Error paths free the partial tree (leak-checked under std.testing.allocator).
• Fixed the ATX # u8 overflow and the frontmatter @intCast panics.

Frontmatter (#73)

• A YAML parse failure no longer leaks the parser's error bundle, asserts on parser internals, or writes diagnostics to stderr from library code. The CLI frontmatter/markdown formats degrade gracefully instead of aborting.
• The underlying rejection of a plain scalar containing an inline " - " is an upstream zig-yaml bug; documented as needing a fork-level fix.

Tooling

• Fuzz harness fixed — every target used the pre-0.16 fn (void, []const u8) signature and never compiled against Zig 0.16's std.testing.fuzz; now uses *std.testing.Smith. Added targets for safe-mode HTML, Typst, and ZON; wired a zig build fuzz smoke check into CI. Fixed the fuzz--fuzz typo in the dev-shell app.
• zig fmt --check gate added as a flake check. Deliberate hand-alignment is preserved with // zig fmt: off / on guards; incidental formatting normalised.
• New src/markdown/security_test.zig regression suite (run by zig build test).

Docs / release

• CHANGELOG ### Security section, README "Rendering Untrusted Markdown" section, SECURITY.md guidance + known limitations, version 0.7.4 → 0.8.0.

Known limitation

The inline link/emphasis scanner is O(n²) on pathological unmatched-bracket input — a CPU-DoS bounded (not eliminated) by max_input_bytes. A delimiter-stack rewrite is deferred to a follow-up; untrusted-input deployments should set a conservative max_input_bytes and a call-site timeout.