morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 07:47:29 +00:00

[GH-ISSUE #4817] [Bug] Apktool locale limit rejects script-region-variant table names #2505

New issue

Closed

opened 2026-10-17 21:05:52 +00:00 by bsakaguchi · 1 comment

bsakaguchi commented

2026-10-17 21:05:52 +00:00

Owner

Originally created by @morluto on GitHub (Oct 17, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/4817

Before submitting

Searched open and closed locale reports; #4612 concerns disclosure and #4777 shared decoding.
Removed credentials and sensitive target data.

Area

Evidence, artifacts, or reconstruction

Observed behavior

At 98886addd, the built shared locale schema rejects b+sr+Latn+RS+REVISED (20 characters) with too_big, maximum 16. b+sr+Latn succeeds. A 23-character structural boundary example, b+fil+Latn+419+ABCDEFGH, is also rejected; this example establishes field widths, not a registered real-world locale.

Reproduction

Executed with pinned Node 24.18.0 after the runtime build:

import { androidLocaleQualifierSchema } from './dist/domain/apktool/apktoolResourceAnalysis.js';
for (const locale of ['b+sr+Latn', 'b+sr+Latn+RS+REVISED']) {
  const result = androidLocaleQualifierSchema.safeParse(locale);
  console.log(locale, result.success, result.success ? [] : result.error.issues);
}

Observed once per input. This is an executed schema boundary control; no APK/JVM/real Apktool reproduction was performed.

Expected behavior

Admit exact locale-only table suffixes that fit the producing Android resource configuration fields. Derive any size bound from their representation and share it across request admission and inventory classification. Preserve aliases, raw caller selection, and combined-configuration disclosure without inferring runtime matching.

Primary source: Apktool ResConfig joins language, optional script, region and variant. BinaryResourceParser reads four script bytes and eight variant bytes; language/region expand to at most three characters. The resulting suffix can reach 2+3+(1+4)+(1+3)+(1+8)=23 characters. This is a source-derived format bound, not proof that every syntactic combination is a valid registered locale.

Impact and scope

Shared src/domain/apktool/apktoolResourceAnalysis.ts uses .max(16); CLI and MCP use that owner. Source-derived: exact longer table selection is blocked before decoding. #4612 now preserves such table names in limitations, but does not make them selectable. Real-app frequency: NOT_ENOUGH_INFO; no APK corpus inspected for this finding.

REA version

6.5.0, 98886adddf

Runtime and platform

Node 24.18.0, macOS arm64

Target and artifact context

Shared schema and authored locale strings; no target execution or actual APK used.

Interface

CLI and MCP (shared schema; adapters not exercised by this control).

Earliest failure stage

Input validation.

Relevant output or evidence

b+sr+Latn: accepted. b+sr+Latn+RS+REVISED: rejected, {code: "too_big", maximum: 16}.

Typed outcome or recovery expected

A selected observed longer locale table can be projected normally with its exact identity; malformed, non-locale and configuration-qualified inputs remain rejected or disclosed appropriately.

Analysis or suspected cause

The 16-character total is independent of the upstream field representation. DeepWiki helped locate the producer; primary source was checked. Context7 Android results did not establish the format details.

Additional context

No new execution/mutation authority; existing static resource decoding only. Validate the SDK-converted schema plus actual CLI/MCP forwarding and provider selection when fixing.

Originally created by @morluto on GitHub (Oct 17, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/4817 ### Before submitting - [x] Searched open and closed locale reports; #4612 concerns disclosure and #4777 shared decoding. - [x] Removed credentials and sensitive target data. ### Area Evidence, artifacts, or reconstruction ### Observed behavior At 98886addd, the built shared locale schema rejects `b+sr+Latn+RS+REVISED` (20 characters) with `too_big`, maximum 16. `b+sr+Latn` succeeds. A 23-character structural boundary example, `b+fil+Latn+419+ABCDEFGH`, is also rejected; this example establishes field widths, not a registered real-world locale. ### Reproduction Executed with pinned Node 24.18.0 after the runtime build: ```js import { androidLocaleQualifierSchema } from './dist/domain/apktool/apktoolResourceAnalysis.js'; for (const locale of ['b+sr+Latn', 'b+sr+Latn+RS+REVISED']) { const result = androidLocaleQualifierSchema.safeParse(locale); console.log(locale, result.success, result.success ? [] : result.error.issues); } ``` Observed once per input. This is an executed schema boundary control; no APK/JVM/real Apktool reproduction was performed. ### Expected behavior Admit exact locale-only table suffixes that fit the producing Android resource configuration fields. Derive any size bound from their representation and share it across request admission and inventory classification. Preserve aliases, raw caller selection, and combined-configuration disclosure without inferring runtime matching. Primary source: Apktool [ResConfig](https://github.com/iBotPeaches/Apktool/blob/fd9d5d4dc7e45fa7f984698ded7a03c554d0a7b3/brut.apktool/apktool-lib/src/main/java/brut/androlib/res/table/ResConfig.java#L215-L235) joins language, optional script, region and variant. [BinaryResourceParser](https://github.com/iBotPeaches/Apktool/blob/fd9d5d4dc7e45fa7f984698ded7a03c554d0a7b3/brut.apktool/apktool-lib/src/main/java/brut/androlib/res/decoder/BinaryResourceParser.java#L532-L577) reads four script bytes and eight variant bytes; language/region expand to at most three characters. The resulting suffix can reach `2+3+(1+4)+(1+3)+(1+8)=23` characters. This is a source-derived format bound, not proof that every syntactic combination is a valid registered locale. ### Impact and scope Shared `src/domain/apktool/apktoolResourceAnalysis.ts` uses `.max(16)`; CLI and MCP use that owner. Source-derived: exact longer table selection is blocked before decoding. #4612 now preserves such table names in limitations, but does not make them selectable. Real-app frequency: NOT_ENOUGH_INFO; no APK corpus inspected for this finding. ### REA version 6.5.0, 98886adddfcbd7b4f4236b3a9825f91878c3cb11 ### Runtime and platform Node 24.18.0, macOS arm64 ### Target and artifact context Shared schema and authored locale strings; no target execution or actual APK used. ### Interface CLI and MCP (shared schema; adapters not exercised by this control). ### Earliest failure stage Input validation. ### Relevant output or evidence `b+sr+Latn`: accepted. `b+sr+Latn+RS+REVISED`: rejected, `{code: "too_big", maximum: 16}`. ### Typed outcome or recovery expected A selected observed longer locale table can be projected normally with its exact identity; malformed, non-locale and configuration-qualified inputs remain rejected or disclosed appropriately. ### Analysis or suspected cause The 16-character total is independent of the upstream field representation. DeepWiki helped locate the producer; primary source was checked. Context7 Android results did not establish the format details. ### Additional context No new execution/mutation authority; existing static resource decoding only. Validate the SDK-converted schema plus actual CLI/MCP forwarding and provider selection when fixing.

bsakaguchi

2026-10-17 21:05:52 +00:00

closed this issue
added the
bug
label

bsakaguchi commented

2026-10-17 21:05:55 +00:00

Author

Owner

@morluto commented on GitHub (Oct 17, 2026):

Fixed in 6385ef435. The shared locale owner now derives 23 characters from Apktool's language/script/region/variant fields. Existing grammar and aliases remain accepted; inventory classification and CLI/MCP admission share this owner.

Validation: 67 focused tests across four files passed, including SDK-converted schema validation, exact longer-table selection, CLI/MCP forwarding, and retained caller parameters. Five controls fail on the previous commit. Static/docs checks and two source reviews passed. Two actual built CLI/stdio MCP calls with an authored launcher selected the longer table; independent digest/count/coverage checks passed.

Twelve ordinary completed CLI/MCP comparisons preserved Evidence (catalog differs only in locale maxLength). Warm medians baseline/candidate: CLI elapsed 0.903/0.905s, CPU 1.164/1.152s, sampled family RSS 519/515 MB; MCP including full discovery elapsed 2.797/2.733s, CPU 3.913/3.663s, sampled family RSS 1353/1263 MB. cl100k full-output estimates unchanged: CLI 498, MCP including discovery 804429. Two alternating repeats per build plus separate first processes; caches were not flushed and sampling may miss transient/reparented processes. No speedup claim.

No real Apktool/JVM, native Windows, large-inventory or true cold verification. Newly admitted long-locale task performance and whole-agent token usage remain unmeasured. The synthetic 23-character boundary is a structural test, not a claim of a registered locale. Heavy profiling/stress stayed stopped.

@morluto commented on GitHub (Oct 17, 2026): Fixed in 6385ef435. The shared locale owner now derives 23 characters from Apktool's language/script/region/variant fields. Existing grammar and aliases remain accepted; inventory classification and CLI/MCP admission share this owner. Validation: 67 focused tests across four files passed, including SDK-converted schema validation, exact longer-table selection, CLI/MCP forwarding, and retained caller parameters. Five controls fail on the previous commit. Static/docs checks and two source reviews passed. Two actual built CLI/stdio MCP calls with an authored launcher selected the longer table; independent digest/count/coverage checks passed. Twelve ordinary completed CLI/MCP comparisons preserved Evidence (catalog differs only in locale maxLength). Warm medians baseline/candidate: CLI elapsed 0.903/0.905s, CPU 1.164/1.152s, sampled family RSS 519/515 MB; MCP including full discovery elapsed 2.797/2.733s, CPU 3.913/3.663s, sampled family RSS 1353/1263 MB. cl100k full-output estimates unchanged: CLI 498, MCP including discovery 804429. Two alternating repeats per build plus separate first processes; caches were not flushed and sampling may miss transient/reparented processes. No speedup claim. No real Apktool/JVM, native Windows, large-inventory or true cold verification. Newly admitted long-locale task performance and whole-agent token usage remain unmeasured. The synthetic 23-character boundary is a structural test, not a claim of a registered locale. Heavy profiling/stress stayed stopped.

bsakaguchi referenced this issue

2026-10-31 01:05:26 +00:00

[PR #2505] [MERGED] feat(recorded-crash): decode AArch64 core register notes #5282

bsakaguchi referenced this issue

2026-10-31 01:08:24 +00:00

[PR #3234] [CLOSED] fix(cli): name both recorded-core architectures in the path contract #5663