fix: enforce !-free cidPrefix invariant at both concatenation sites

The cid: namespacing scheme (cid:<prefix>!<id>) is only unambiguous
because the prefix half is guaranteed free of '!': the first '!' in the
result is always the separator, so an attacker-controlled Content-ID
containing '!' only extends the id half rather than colliding with a
different prefix. That invariant previously existed only as a comment.

Add Q_ASSERT_X at both independent call sites that perform this
concatenation (CidSchemeHandler::namespacedKey and
HtmlBuilder::namespaceCids) so a future prefix generator that violates it
traps in debug builds, per Task 5's precedent of not letting one unit's
correctness depend silently on another's future behaviour. Since
Q_ASSERT compiles out in release, pin the property that actually matters
release builds too test: distinct (prefix, id) pairs across a documented
"m<index>" prefix set and hostile Content-IDs (containing '!', percent-
encoded '!', empty, leading/trailing '!') never collide, and the key
always splits at its first '!' back to the exact original prefix.

1 files changed, 9 insertions, 0 deletions

diff --git a/src/htmlbuilder.h b/src/htmlbuilder.h
index ac24e28..ff62c69 100644
--- a/src/htmlbuilder.h
+++ b/src/htmlbuilder.h
@@ -16,6 +16,15 @@ struct ThreadRenderItem
     /// use the same Content-ID (cid:logo@example.org), which would collide in
     /// a single document, so every reference is rewritten to
     /// cid:<prefix>!<id>.
+    ///
+    /// Requirement on whatever generates this value: it must never contain
+    /// '!'. The separator that makes cid:<prefix>!<id> unambiguous is the
+    /// FIRST '!' in the namespaced string; that only holds if the prefix
+    /// half is guaranteed free of the character, since the id half is
+    /// attacker-controlled and may legitimately contain '!' itself. The
+    /// documented "m<index>" form (e.g. "m0", "m1") satisfies this. Enforced
+    /// with Q_ASSERT at both places that perform this concatenation
+    /// (HtmlBuilder::namespaceCids and CidSchemeHandler::namespacedKey).
     QString cidPrefix;
 };