[PR #689] [CLOSED] fix(browser): reject malformed indexed source-map offsets #2170

New issue

Closed

opened 2026-10-16 21:15:11 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-16 21:15:11 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/689
Author: @rudycelekli
Created: 10/6/2026
Status: ❌ Closed

Base: main ← Head: fix/rea-indexed-map-offsets-20261006

📝 Commits (1)

0c049e8 fix(browser): reject malformed indexed source-map offsets

📊 Changes

2 files changed (+51 additions, -1 deletions)

View changed files

📝 src/browser/WebSourceMapFetcher.ts (+10 -1)
📝 tests/boundary/browser/webSourceMapFetcher.test.ts (+41 -0)

📄 Description

What changed

Indexed source-map section offsets are validated as nonnegative safe integers before decoding. Malformed line/column values now produce an invalid map item instead of escaping into the complete collection's schema validation and aborting browser analysis.

Consumer evidence

With an owned loopback page captured by actual Chrome 154, a source map whose section has column: -1 previously caused the complete public CdpBrowserProvider.analyzeBundle workflow to return ProviderAdapterError. Afterward the result succeeds with partial completeness, an invalid map item, and the independent /api/control endpoint retained. A positive section-offset control remains included with its generated line/column coordinates intact.

Verification

Five malformed-offset boundary cases fail before the patch; eight malformed cases pass after, including negative/string/fractional/missing/unsafe coordinates.
Focused source-map fetch and response-cleanup suites: 33 passed.
npm run check, npm run check:fast, git diff --check: passed.
Full npm run verify:browser: passed with actual Chrome and public CLI/stdio browser workflows.
Complete public provider malformed-map and positive-offset captures plus consumer assertions: passed.

No new tool, schema or execution authority. This is malformed-input reliability, not an authentication or security bypass claim. Hopper/Ghidra verification was not run because no binary provider behavior changes. AI assistance was used for investigation, implementation and verification. Hosted checks are pending on publication.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/689 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/6/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/rea-indexed-map-offsets-20261006` --- ### 📝 Commits (1) - [`0c049e8`](https://github.com/morluto/rea/commit/0c049e838e10c46bf54d8a14f168f5226e53e480) fix(browser): reject malformed indexed source-map offsets ### 📊 Changes **2 files changed** (+51 additions, -1 deletions) <details> <summary>View changed files</summary> 📝 `src/browser/WebSourceMapFetcher.ts` (+10 -1) 📝 `tests/boundary/browser/webSourceMapFetcher.test.ts` (+41 -0) </details> ### 📄 Description ## What changed Indexed source-map section offsets are validated as nonnegative safe integers before decoding. Malformed line/column values now produce an `invalid` map item instead of escaping into the complete collection's schema validation and aborting browser analysis. ## Consumer evidence With an owned loopback page captured by actual Chrome 154, a source map whose section has `column: -1` previously caused the complete public `CdpBrowserProvider.analyzeBundle` workflow to return `ProviderAdapterError`. Afterward the result succeeds with partial completeness, an invalid map item, and the independent `/api/control` endpoint retained. A positive section-offset control remains included with its generated line/column coordinates intact. ## Verification - Five malformed-offset boundary cases fail before the patch; eight malformed cases pass after, including negative/string/fractional/missing/unsafe coordinates. - Focused source-map fetch and response-cleanup suites: 33 passed. - `npm run check`, `npm run check:fast`, `git diff --check`: passed. - Full `npm run verify:browser`: passed with actual Chrome and public CLI/stdio browser workflows. - Complete public provider malformed-map and positive-offset captures plus consumer assertions: passed. No new tool, schema or execution authority. This is malformed-input reliability, not an authentication or security bypass claim. Hopper/Ghidra verification was not run because no binary provider behavior changes. AI assistance was used for investigation, implementation and verification. Hosted checks are pending on publication. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-16 21:15:11 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-10-31 01:03:55 +00:00

[PR #2232] [MERGED] fix(process): report single empty settlement observation as unverifiable #5100

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#2170

No description provided.

Rows
Columns