# 2026-09-28 — A posted doc could run script on the Booth's origin

**Found by design-dev's impeccable run** (the whole-surface audit Prime asked
for, report booth `booth-antislop`), confirmed at source by booth-dev:
Python-Markdown passes raw HTML through and `doc.html` / `booth.html` render it
`|safe`. Any session's `.md` could carry a `<script>`; a contract that merely
QUOTED `<pre>` opened a real one and swallowed the rest of the doc.

**Operator ruling (Prime, in this session: "A"; and in design-dev's): ESCAPE
raw HTML, not an allowlist** — the live docs that carry tags mean the literal
tag, and an allowlist would still turn a quoted `<pre>` into a real one.
Measured before shipping: 2 of 19 live `.md` files render differently; one is
`booth-redesign/03-u1-item-record.contract.md` losing exactly the swallowing
`<pre>`, the other is `links/links.md`, which renders as a board and never
through `render_doc`.

**Found while fixing it, same class:** markdown link hrefs were never checked,
and Python-Markdown keeps character references in attributes, so
`[x](java&#115;cript:...)` reached the browser as `javascript:`. Every doc href
now goes through `links.is_safe_href` after browser-style decoding
(`_browser_href`). mailto autolinks lose their href as a result; accepted.

**The heid panel (4/4, thread `01M3MFG07JCAJTQXRBC1GKS2FG`) said the core
claim holds** and found its edges: `/\evil.test` passed `is_safe_href` as a
relative path although a browser reads it as `//evil.test` (fixed in the ONE
predicate, so the board is closed too); no bound around the render (fixed:
a raising render falls back to escaped raw text, which also covers a markdown
upgrade renaming the deregistered processors — the tests would go red on that
upgrade). Declined: emphasis still applying inside quoted HTML (`**x**` in a
quoted attribute renders bold) — that is prose getting markdown; quote in a
code span for byte-literal. Accepted: `img@src` unguarded (inert in current
browsers; data: images are legitimate), `html.unescape` as a superset of
attribute decoding (over-refuses at worst).

**Guards not claimed as falsifiers:** the tab/CR/LF drop and C0 trim in
`_browser_href`, because Python 3.13's urlsplit does the same; the
AMP_SUBSTITUTE restore, reachable only through automail (always `mailto:`).
Table: `tests/mutations/doc_html.toml`, 9/9 proved.