shankar0123 5ec5ba7c82 ci: convert literal Unicode in headers_test.go to \u escapes (ST1018) ...

CI run #448 (commit b9478d0) failed staticcheck ST1018 on six test
inputs that embedded literal invisible Unicode (U+202E RTL override,
U+202D LRO, U+2066 LRI, U+200B ZWS, U+200C ZWNJ, U+180E MVS).
golangci-lint enforces ST1018 in CI but go vet doesn't, so the
local pre-commit gate (gofmt + go vet + go test) didn't catch it —
the canonical Bundle 9 staticcheck-vs-vet drift case CLAUDE.md
explicitly warns about.

Fix: convert each literal-Unicode test input to its \uXXXX ASCII
escape form. Verified via byte-level Python sed against UTF-8 byte
sequences (\xe2\x80\xae -> ‮, \xe2\x80\xad -> ‭,
\xe2\x81\xa6 -> ⁦, \xe2\x81\xa9 -> ⁩, \xe2\x80\x8b ->
​, \xe2\x80\x8c -> ‌, \xe1\xa0\x8e -> ᠎). The U+202C
(PDF — Pop Directional Formatting) closer was caught by the same
sweep since two RTL/LRO test cases use it.

The runtime semantics are byte-identical — Go interprets ‮
and the literal U+202E byte sequence to the same rune. Only the
source text changed.

Verified locally:
  gofmt -l internal/validation/: clean.
  go vet ./...: exit 0.
  go test -short -count=1 ./internal/validation/...: ok 0.014s
    (all 4 test cases in TestSanitizeEmailBodyValue_StripsBidiOverride
    + the rest of the suite still green — semantics unchanged).
  Sandbox couldn't install staticcheck (disk pressure on
  /tmp/gopath), but the rule is mechanical: U+XXXX format chars in
  string literals must use \uXXXX. Every flagged literal is fixed.

Reference: CI run https://github.com/certctl-io/certctl/actions/runs/25301809013

Closes the staticcheck regression on commit b9478d0
(security(email): sanitize body fields against content injection).

2026-05-04 05:00:14 +00:00

..

command_fuzz_test.go

Bundle O (Coverage Audit Closure): test hygiene + FSM coverage tables — M-004 + M-005 + M-006 closed

2026-04-27 18:06:06 +00:00

command_test.go

chore(fmt): repo-wide gofmt -w sweep — close drift surfaced by ci-pipeline-cleanup Phase 4

2026-04-30 22:33:57 +00:00

command.go

fix(security): TICKET-009 add HTTP timeouts to notifier clients

2026-03-27 21:33:31 -04:00

headers_test.go

ci: convert literal Unicode in headers_test.go to \u escapes (ST1018)

2026-05-04 05:00:14 +00:00

headers.go

security(email): sanitize body fields against content injection (CodeQL #11, CWE-640)

2026-05-04 04:56:13 +00:00

ssrf_test.go

security: add SSRF defence-in-depth for webhook notifier (fixes H-4)

2026-04-17 00:34:47 +00:00

ssrf.go

acme-server: HTTP-01 + DNS-01 + TLS-ALPN-01 challenge validation (Phase 3/7)

2026-05-03 14:09:00 +00:00

unicode_test.go

Bundle 9 follow-up: ST1018 ESC sweep + make verify pre-commit gate

2026-04-26 21:17:12 +00:00

unicode.go

Bundle 9: Local-issuer hardening — 5 findings closed + 1 partial

2026-04-26 17:18:00 +00:00