Lighthouse: lighthouse: arbitrary local-namespace injection via attacker-controlled labelsourcenamespace