fix(evidence): reject ambiguous network metadata names

[seonghobae]

Buyer/protocol-integrity gap

NetworkEvidence::capture reused one generic metadata-name validator for both HTTP header fields and query fields. That boundary accepted HTTP separator characters in header field names even though RFC 9110 defines a field name as token (1*tchar). It also allowed bidi, zero-width, soft-hyphen, and byte-order-mark characters in query field names, so redacted audit evidence could be visually reordered or hidden while preserving attacker-controlled field-name bytes.

Query parameter names remain a separate syntax domain from HTTP field names: printable Unicode query names are preserved, but control and reviewed invisible formatting characters fail closed.

Live dependency and stack state

This Draft targets exact PR #162 head aa66e9eef466ae39900352a342381f65ade2309e, transitively on #157. #162 owns the adjacent provenance-locator presentation hardening and EvidenceError::InvalidLocator; this branch owns HTTP field-name grammar plus query-name presentation integrity. Content-aware merge commit 9cf10f985795dcbe5b31852895f786e2fc7ef5d2 preserves both production contracts rather than allowing either sibling to drop the other's lib.rs and changelog semantics.

Fresh ancestry is ahead 9 / behind 0 with merge base exactly aa66e9eef466ae39900352a342381f65ade2309e. Keep Draft while #162/#157 remain active. No prerequisite check, review, mergeability, or approval evidence transfers.

Test-first evidence and implementation

HTTP field-name grammar

• Initial test-only head 1724ba47579155e46f400090011c4ed670fb9938 failed only at cargo fmt --check, so that run was not accepted as semantic RED.
• Formatting-only test head 1baf036651dab0f5f2160142d8845d19faf901a8 reached the intended semantic boundary in CI run 31855601735, Rust job 94939662832: bad:name was accepted as Ok(NetworkEvidence) instead of failing closed. The companion regression preserving the complete RFC 9110 tchar punctuation set and an independent query name such as filter:status passed. This is the valid RED.
• Production split header-name validation from generic query metadata validation. Headers retain existing count/name/value bounds, then require every byte to be ASCII alphanumeric or RFC 9110 tchar punctuation (!#$%&'*+-.^_|~`).

Query-name presentation integrity

• Exact test-only head acef77fa3ac56bfc6dfa120ab764ee879a13c79b added hostile query names containing U+202E, U+200B, U+00AD, U+2066, and U+FEFF while preserving a printable Korean query name.
• CI run 31938663213 passed repository contracts, canonical formatting, and workspace check, then failed network_evidence_rejects_invisible_query_field_names because the U+202E field name was returned as Ok(NetworkEvidence). The printable Unicode companion passed. This is the valid RED.
• Production head e564d0e6f0338d8eaf6d83451d6b0998bef40515 introduced one shared evidence-presentation validator for control and reviewed invisible Unicode formatting characters. Query metadata and provenance locators reuse it without conflating query syntax with HTTP token grammar.
• Current exact head c3bfdda76813ec1fc8058d4cca5f95f5d2fe9479 adds the truthful Unreleased query-presentation security record.

Every captured metadata value remains unconditionally redacted. Hostile regressions reject malformed HTTP field names containing colon, comma, equals, parentheses, brackets, braces, slash, question mark, at-sign, quote, and backslash, plus invisible query-name presentation controls.

Exact-current proof

On unchanged exact head c3bfdda76813ec1fc8058d4cca5f95f5d2fe9479 against exact live base aa66e9eef466ae39900352a342381f65ade2309e:

• CI run 31939233804: success;
• Rust contracts: repository contracts, canonical formatting, locked workspace/all-target checks, full tests, strict Clippy, and rustdoc success;
• Production coverage: exact owned production function/line/region/branch enforcement success;
• GitHub reports the Draft mergeable with ancestry ahead 9 / behind 0;
• no submitted formal reviews are returned; and
• no inline review threads are returned.

Security/SAST/central/model workflows not returned for this stacked Draft are not represented as passing. No predecessor-head, prerequisite-head, synthetic-merge, queued, pending, skipped, cancelled, absent, stale, status-only, or model-only evidence is promoted to current-head proof.

Scope boundary

This lane changes only credential-safe network-evidence admission. It performs no HTTP parsing, network I/O, browser execution, persistence, secret handling, workflow mutation, or release action. The scheduled actor does not merge or self-approve.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 3606ddd3-85bc-4070-baac-92060f8817c8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}