Proof Portal
Omarchy
ProbeLabsviewing a historical runA proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.
stripJsonc comma regex rewrites strings that carry a comma before } or ] (omacom/omarchy#13250)
Medium-severity issue, currently open.
Description
The issue as recorded.
stripJsonc (shell/plugins/menu/MenuModel.js:2-6) drops trailing commas with the regex /,(\s*[}\]])/g. The regex does not track string literals. It also deletes a comma inside a label or an action when optional whitespace and } or ] follow it.
JSON.parse accepts the rewritten text, so nothing fails. The label "x, ]y" renders as "x ]y". The action "mv f{.bak,}" runs as "mv f{.bak}" with the user privileges. Upstream issue: omacom/omarchy#13250. Report intake validated it (report cmulr8l6h0i461gw40vqqv64c).
Affected requirements
The requirement(s) this issue violates — click through to the spec.
Severity, explained
Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).
- why this rating
- Risk-rated
- risk area
- Data Integrity
- CVE surface
- None
Where it is
The code the issue lives in — peek the affected function inline to see it in context.
- MenuModel.parseMenuJsonc / stripJsonc trailing-comma pass (default and user menu JSONC)
How it's proven
The reproducer — an actual test that drives the real code and shows the issue happening. Run it yourself, or peek the test and the source it covers.
sh test/reports/report-cmulr8l6h0i461gw40vqqv64c.sh
Reproduction steps
Technical steps for your engineers to confirm the issue by hand.
sh test/reports/report-cmulr8l6h0i461gw40vqqv64c.sh
What protects you, and the fix
What limits your exposure today, and the planned remediation.
What protects you now
The defect needs a user or extension string with a comma directly before } or ]. The shipped default menu has no such string. An author can drop the comma or put a character between the comma and the closer
The fix
Replace the comma regex with a string-aware pass that copies string literals verbatim, as omacom/omarchy#13968 does (SW-REQ-260927-66FW on its proof mirror). The pass must still drop a trailing comma when comment lines and the closer come after it. The preservation tests pin that shape.
Blast radius
If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them. Historical view: authored trace links only — automatically derived links aren't reconstructible for past runs.
Touch this finding and you re-check 1 requirements · 2 code files · 2 tests.
- Menu.qml
- MenuModel.js
- menumodel-replay.test.mjs
- menu-test.sh
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Per-requirement evidence
For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
Evidence trail
The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.
- proof/evidence/ki-menu-jsonc-comma-in-string.yaml
Change history
Every recorded revision of this finding's source file — when it was added, edited, or re-classified, with the diff for each change.
Discussions
Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.