[PR #1095] [MERGED] fix(apple): decode Interface Builder XML byte encodings #2644

New issue

Closed

opened 2026-10-17 21:08:33 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-17 21:08:33 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/1095
Author: @rudycelekli
Created: 10/8/2026
Status: ✅ Merged
Merged: 10/8/2026
Merged by: @N0zoM1z0

Base: main ← Head: validation/interface-builder-xml-encoding-20261008

📝 Commits (3)

cf37cff test(apple): qualify native Interface Builder XML encodings
2af09e8 fix(apple): share BOM-aware Interface Builder XML decoding
f075052 fix(apple): reject unsupported XML encoding declarations

📊 Changes

8 files changed (+558 additions, -22 deletions)

View changed files

📝 docs/native-investigation.md (+6 -0)
📝 src/artifacts/apple/InterfaceBuilderAnalysis.ts (+3 -1)
📝 src/artifacts/apple/KeyedArchiveReader.ts (+2 -21)
➕ src/artifacts/apple/XmlPropertyListText.ts (+30 -0)
➕ tests/boundary/filesystem/appleXmlDeclarations.test.ts (+78 -0)
📝 tests/boundary/filesystem/interfaceBuilderBundle.test.ts (+89 -0)
➕ tests/conformance/native/interface-builder-encoding.swift (+137 -0)
➕ tests/fixtures/interfaceBuilderEncoding.ts (+213 -0)

📄 Description

Summary

Reuse the existing BOM-aware, fatal XML plist decoder for Interface Builder archives. Its current Buffer.toString("utf8") decoding loses UI graphs for valid UTF-8 BOM and UTF-16 archives, while malformed UTF-8 and UTF-8 declaring UTF-16 can become accepted graphs.

Extract the unchanged general keyed-archive decoder into a shared artifact helper and call it from both readers. Original serialized-byte SHA256 provenance and binary-plist decoding remain unchanged. Document supported byte encodings and incompatible UTF-16 declaration checks. Supports the existing static archive/provenance contract in #480.

Frozen native regression proof

An actual AppKit NSView root with two children is archived by Foundation NSKeyedArchiver. Foundation validates UTF-8/BOM UTF-8/UTF-16LE/UTF-16BE/binary representations. A separate Foundation XML object-table oracle supplies actual archive UIDs, NSView class/identifiers and nonempty root-child relationships; the tests do not equate an authored field with an archive UID.

Eighteen frozen Darwin tests exercise filesystem analysis and the compiled public CLI, including malformed UTF-8, incomplete UTF-16, declaration mismatch, UTF-8 and binary controls. Positive assertions verify identity, hierarchy, graph parity and original archive digests in every node/edge evidence record. This is inert archive analysis, with no application execution or runtime rendering claim.

BEFORE: tests-only signed cf37cff177d8a13b6aeb11f745d071bce4e463e1; native Apple job reproduced 10 decoder failures / 8 passing controls. All 44 existing tests in that step passed; producer and oracle checks passed. Later Apple integration steps skipped on the expected red baseline.
AFTER: signed 2af09e89874ee9a5d2b70697657b5c85bd730727; unchanged full CI passed all 22 jobs. Native Apple job passed 18/18 frozen regressions + 44 existing controls, the neighboring general keyed-archive native verifier and later Apple integrations.
Four official Vitest shard artifacts verified by ZIP/blob digests: 4990 pass, 66 platform skips, zero retries or unhandled errors. Linux skips of Darwin tests provide no native proof. Static checks, docs generation, source-built conformance and every native package lane passed.

No CI jobs, assertions, dependency graph or application execution policy are changed. The exported helper's statement text equals the prior general keyed-archive implementation, apart from the export keyword. Independent cold review found no actionable concerns.

The shared decoder also rejects unsupported XML encoding declarations rather than silently treating their bytes as UTF-8. This applies to both keyed archives and Interface Builder. Four portable consumer regressions failed before the fix; 23 focused tests now pass (24 native-only cases skipped on Linux). Native Foundation filesystem/CLI controls now also cover unknown and Latin-1 declarations. Static and generated-document checks pass. Final native CI remains required.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/1095 **Author:** [@rudycelekli](https://github.com/rudycelekli) **Created:** 10/8/2026 **Status:** ✅ Merged **Merged:** 10/8/2026 **Merged by:** [@N0zoM1z0](https://github.com/N0zoM1z0) **Base:** `main` ← **Head:** `validation/interface-builder-xml-encoding-20261008` --- ### 📝 Commits (3) - [`cf37cff`](https://github.com/morluto/rea/commit/cf37cff177d8a13b6aeb11f745d071bce4e463e1) test(apple): qualify native Interface Builder XML encodings - [`2af09e8`](https://github.com/morluto/rea/commit/2af09e89874ee9a5d2b70697657b5c85bd730727) fix(apple): share BOM-aware Interface Builder XML decoding - [`f075052`](https://github.com/morluto/rea/commit/f075052d716cfc1f36b5a961ea906f91be46e300) fix(apple): reject unsupported XML encoding declarations ### 📊 Changes **8 files changed** (+558 additions, -22 deletions) <details> <summary>View changed files</summary> 📝 `docs/native-investigation.md` (+6 -0) 📝 `src/artifacts/apple/InterfaceBuilderAnalysis.ts` (+3 -1) 📝 `src/artifacts/apple/KeyedArchiveReader.ts` (+2 -21) ➕ `src/artifacts/apple/XmlPropertyListText.ts` (+30 -0) ➕ `tests/boundary/filesystem/appleXmlDeclarations.test.ts` (+78 -0) 📝 `tests/boundary/filesystem/interfaceBuilderBundle.test.ts` (+89 -0) ➕ `tests/conformance/native/interface-builder-encoding.swift` (+137 -0) ➕ `tests/fixtures/interfaceBuilderEncoding.ts` (+213 -0) </details> ### 📄 Description ## Summary Reuse the existing BOM-aware, fatal XML plist decoder for Interface Builder archives. Its current `Buffer.toString("utf8")` decoding loses UI graphs for valid UTF-8 BOM and UTF-16 archives, while malformed UTF-8 and UTF-8 declaring UTF-16 can become accepted graphs. Extract the unchanged general keyed-archive decoder into a shared artifact helper and call it from both readers. Original serialized-byte SHA256 provenance and binary-plist decoding remain unchanged. Document supported byte encodings and incompatible UTF-16 declaration checks. Supports the existing static archive/provenance contract in #480. ## Frozen native regression proof An actual AppKit NSView root with two children is archived by Foundation NSKeyedArchiver. Foundation validates UTF-8/BOM UTF-8/UTF-16LE/UTF-16BE/binary representations. A separate Foundation XML object-table oracle supplies actual archive UIDs, NSView class/identifiers and nonempty root-child relationships; the tests do not equate an authored field with an archive UID. Eighteen frozen Darwin tests exercise filesystem analysis and the compiled public CLI, including malformed UTF-8, incomplete UTF-16, declaration mismatch, UTF-8 and binary controls. Positive assertions verify identity, hierarchy, graph parity and original archive digests in every node/edge evidence record. This is inert archive analysis, with no application execution or runtime rendering claim. - **BEFORE:** tests-only signed `cf37cff177d8a13b6aeb11f745d071bce4e463e1`; [native Apple job](https://github.com/rudycelekli/rea/actions/runs/37803405079/job/113401363800) reproduced **10 decoder failures / 8 passing controls**. All 44 existing tests in that step passed; producer and oracle checks passed. Later Apple integration steps skipped on the expected red baseline. - **AFTER:** signed `2af09e89874ee9a5d2b70697657b5c85bd730727`; [unchanged full CI](https://github.com/rudycelekli/rea/actions/runs/37805624822) passed **all 22 jobs**. [Native Apple job](https://github.com/rudycelekli/rea/actions/runs/37805624822/job/113409097581) passed **18/18 frozen regressions + 44 existing controls**, the neighboring general keyed-archive native verifier and later Apple integrations. - Four official Vitest shard artifacts verified by ZIP/blob digests: **4990 pass, 66 platform skips, zero retries or unhandled errors**. Linux skips of Darwin tests provide no native proof. Static checks, docs generation, source-built conformance and every native package lane passed. No CI jobs, assertions, dependency graph or application execution policy are changed. The exported helper's statement text equals the prior general keyed-archive implementation, apart from the export keyword. Independent cold review found no actionable concerns. The shared decoder also rejects unsupported XML encoding declarations rather than silently treating their bytes as UTF-8. This applies to both keyed archives and Interface Builder. Four portable consumer regressions failed before the fix; 23 focused tests now pass (24 native-only cases skipped on Linux). Native Foundation filesystem/CLI controls now also cover unknown and Latin-1 declarations. Static and generated-document checks pass. Final native CI remains required. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-17 21:08:33 +00:00