Proof Portal

Sign in
Project overview

Omarchy

ProbeLabsviewing a historical run

A proof layer — requirements, tests and verified fixes — for two of Omarchy's subsystems: the application menu (launcher scripts, QML model, JSONC config, search and selection) and the lock screen (lock scripts, QML, PAM authentication). Scope is deliberately limited to those components of omacom/omarchy; the rest of the distribution is not covered.

Viewing historical run 5a62332Oct 2, 2026, 04:06 PMpr/14054Back to current
Back to findings
Known issueKI-MENU-JSONC-UNICODE-WHITESPACE

Unicode or control whitespace between JSONC tokens empties the whole menu file

OpenOpenMedium

Medium-severity issue, currently open.

Description

The issue as recorded.

parseMenuJsonc (shell/plugins/menu/MenuModel.js) hands the stripped text to JSON.parse. JSON.parse accepts only space, tab, LF and CR as whitespace. The JavaScript \s class in the comment pass is wider: VT, FF, U+00A0, U+1680, U+2000 to U+200A, U+2028, U+2029, U+202F, U+205F, U+3000 and U+FEFF. The comment pass removes such a character together with a whole-line // comment that it indents. Anywhere else between tokens, JSON.parse throws. The catch then returns an empty item set for the whole file. A user extension pasted from a web page or a word processor often carries no-break spaces. That file silently loses every entry, with no diagnostic. We checked this live under Quickshell 0.3.1. FileView keeps these characters as read and drops only a leading byte-order mark. The real MenuModel.js parses a file with one U+00A0 or U+000B between tokens to 0 rows. pocs/menu-jsonc-unicode-whitespace.sh reproduces it for all 21 characters against an ASCII-space control. test/shell.d/menu-test.sh pins it as a green tripwire.

Affected requirements

The requirement(s) this issue violates — click through to the spec.

SW-REQ-260922-E4J2SW-REQ-260922-3T3F

Severity, explained

Why this is rated the way it is — and the scoring signals behind the rating (each ⓘ explains the term).

MediumRated severity — the impact if this issue is exploited or hit.
why this rating
Risk-rated
risk area
Correctness
Security classification
Not a security surface
CVE surface
None

Where it is

The code the issue lives in — peek the affected function inline to see it in context.

  • MenuModel.parseMenuJsoncdefault and user menu JSONC

How it's proven

The reproducer — an actual test that drives the real code and shows the issue happening. Run it yourself, or peek the test and the source it covers.

Known issue reproducedprofileknown_issue_reproducer
Reproducer test
Run it yourself
sh pocs/menu-jsonc-unicode-whitespace.sh
Covers (2)
Last run Oct 1, 2026, 11:46 PM

Reproduction steps

Technical steps for your engineers to confirm the issue by hand.

sh pocs/menu-jsonc-unicode-whitespace.sh

What protects you, and the fix

What limits your exposure today, and the planned remediation.

What protects you now

Replace no-break spaces and other non-ASCII spaces in the menu file with ASCII spaces. The shipped default menu carries none.

The fix

Read every JS whitespace character outside a string literal as plain whitespace before JSON.parse, as omacom/omarchy#13968 does (characters inside strings stay data). Close criterion: pocs/menu-jsonc-unicode-whitespace.sh exits 0 and the KI-MENU-JSONC-UNICODE-WHITESPACE tripwires in test/shell.d/menu-test.sh flip red.

Blast radius

If you touch this issue, what else may need re-checking — the requirements it affects and the code and tests that hang off them. Historical view: authored trace links only — automatically derived links aren't reconstructible for past runs.

Tracing blast radius…

Touch this finding and you re-check 2 requirements · 2 code files · 2 tests.

Requirements (2)
SW-REQ-260922-E4J2SW-REQ-260922-3T3F
Code files (2)
  • Menu.qml
  • MenuModel.js
Tests (2)
  • menumodel-replay.test.mjs
  • menu-test.sh

Per-requirement evidence

For each requirement this finding touches: the implementing code, verifying tests, and proof obligations that discharge it.

SW-REQ-260922-E4J2
Implementing code (3)
  • shell/plugins/menu/Menu.qml
    item
  • shell/plugins/menu/MenuModel.js
    parseMenuJsonc
  • shell/plugins/menu/MenuModel.js
    stripJsonc
Tests & evidence (2)
  • test/node/menumodel-replay.test.mjs
  • test/shell.d/menu-test.sh
Proof obligations (1)
input_domain

A parser, reader, or configuration loader states its accepted input domain at the byte level and what happens for each partition of it.

  • ✓nominal (required) — test/shell.d/menu-test.sh:257, test/shell.d/menu-test.sh:262, test/shell.d/menu-test.sh:272, test/shell.d/menu-test.sh:280
  • ✓negative — test/shell.d/menu-test.sh:297
SW-REQ-260922-3T3F
Implementing code (3)
  • shell/plugins/menu/Menu.qml
    item
  • shell/plugins/menu/MenuModel.js
    parseMenuJsonc
  • shell/plugins/menu/MenuModel.js
    stripJsonc
Tests & evidence (2)
  • test/node/menumodel-replay.test.mjs
  • test/shell.d/menu-test.sh
Proof obligations (3)
boundary

Behavior at limits, thresholds, and edge-of-range values.

  • ✓nominal (required) — test/shell.d/menu-test.sh:98
  • ✓negative — test/node/menumodel-replay.test.mjs:120, test/shell.d/menu-test.sh:113
error_handling

Behavior when operations fail or dependencies are unavailable.

  • ✓negative (required) — test/node/menumodel-replay.test.mjs:1048, test/shell.d/menu-test.sh:92
  • ✓nominal (required) — test/shell.d/menu-test.sh:64
input_domain

A parser, reader, or configuration loader states its accepted input domain at the byte level and what happens for each partition of it.

  • ✓nominal (required) — test/shell.d/menu-test.sh:293
  • ✓negative — test/shell.d/menu-test.sh:287

Evidence trail

The raw evidence manifests behind this finding — superseded by the resolved reproducer above, kept here for traceability.

  • proof/evidence/ki-menu-jsonc-unicode-whitespace.yaml

Change history

Every recorded revision of this finding's source file — when it was added, edited, or re-classified, with the diff for each change.

Discussions

Discuss this with the proof team. Nothing changes in your audit automatically — you open a request and a staff member records any outcome inside the thread.

Sign in to discuss this with the proof team.Sign in