fix(loop): reject ambiguous YAML controls

Author: codeacme17

loops/issue-dev-loop/scripts/lib/validation.mjs

@@ -7,6 +7,9 @@ import {
   consumeHistoricalValidationCapability,
 } from './github-identity.mjs'
 
+const unsupportedYamlCharacters =
+  /[\u0000-\u0009\u000b\u000c\u000e-\u001f\u007f-\u009f\u2028\u2029]/u
+
 async function collectFiles(root, output = []) {
   const entries = await readdir(root, { withFileTypes: true })
   for (const entry of entries) {
@@ -49,7 +52,7 @@ export function validateFinalizationHistory(historyLines) {
 
 function activeYamlLines(source) {
   return source
-    .split(/\r?\n/)
+    .split(/\r\n|[\r\n]/)
     .map((line) => line.replace(/\s+$/, ''))
     .filter((line) => line.trim() && !line.trimStart().startsWith('#'))
 }
@@ -110,6 +113,7 @@ function conservativeYamlBlock(
 }
 
 export function historicalWorkflowIsLowPrivilege(source) {
+  if (unsupportedYamlCharacters.test(source)) return false
   const lines = activeYamlLines(source)
   if (
     lines.some(

loops/issue-dev-loop/tests/runtime.test.mjs

@@ -5436,6 +5436,23 @@ test('historical workflow parsing is fail-closed without exposing reduced valida
         '    runs-on: ubuntu-latest\n',
         '    - permissions: write-all\n    runs-on: ubuntu-latest\n',
       ),
+      historicalWorkflow.replace(
+        '    runs-on: ubuntu-latest\n',
+        '    runs-on: ubuntu-latest\r    permissions: write-all\n',
+      ),
+      historicalWorkflow.replace(
+        '    runs-on: ubuntu-latest\n',
+        '    runs-on: ubuntu-latest\u0085    permissions: write-all\n',
+      ),
+      historicalWorkflow.replace(
+        '    runs-on: ubuntu-latest\n',
+        '    runs-on: ubuntu-latest\u2028    permissions: write-all\n',
+      ),
+      historicalWorkflow.replace(
+        '    runs-on: ubuntu-latest\n',
+        '    runs-on: ubuntu-latest\u2029    permissions: write-all\n',
+      ),
+      historicalWorkflow.replace('ubuntu-latest', 'ubuntu-latest\u0000'),
       `${historicalWorkflow}
 !!str permissions: write-all
 `,