morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #5096] [Bug] Windows JADX selects a current-directory java.exe before the selected PATH JDK #3133

New issue

Closed

opened 2026-10-31 00:37:01 +00:00 by bsakaguchi · 2 comments

bsakaguchi commented

2026-10-31 00:37:01 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 18, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/5096

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

Setup, packaging, or upgrade

Observed behavior

SOURCE-ONLY: Windows JADX configuration prepends the process working directory to the selected PATH directories when JAVA_HOME is absent. It returns the first readable regular java.exe. Consequently, an unrelated current-directory java.exe wins over a different JDK selected through PATH, even when the current directory is absent from PATH.

The production caller passes that selected path directly to the Java prerequisite probe and, after validation, the engine session. No Windows runtime or provider execution was performed.

Reproduction

Static verification performed against the source revision below:

Trace the supported APK caller in JadxProvider.ts:435-446 into configuration resolution:239-280.
Confirm host admission:490-536 permits Windows x64 with matching native controls and owned protocol stdin.
Inspect Java lookup:576-623. With JAVA_HOME absent, the candidate list begins with process.cwd(); the first acceptable java.exe returns immediately.
Confirm validation:283-290 probes configuration.java and session creation:543-558 uses it as the command.

This establishes selection statically for an accessible current-directory java.exe and a distinct PATH JDK, with the current directory excluded from PATH. NOT_ENOUGH_INFO: no real Windows reproduction or frequency measurement.

Expected behavior

Use the selected Windows PATH when JAVA_HOME is absent, as described by the Android setup guide:81-96. An unrelated working-directory file should not override that selection unless the caller includes its directory in PATH.

Impact and scope

Source-derived scope: supported Windows x64 JADX admission with JAVA_HOME absent and an accessible java.exe in the process working directory. The selected runtime can differ from the PATH JDK. An unusable current-directory runtime can fail admission despite a usable PATH JDK; a valid alternative runtime can pass validation and be used for the session. Neither consequence was executed on Windows, and real-world frequency is unknown.

The documented workaround is to set an absolute JAVA_HOME. The selector:622-623 then returns its bin/java.exe without searching the working directory. No security impact is asserted.

REA version

Source 3537e58c1a; package manifest 6.7.0. Current-main static verification only. Relevant production source is identical to the rea-agents-6.7.0 tag; no released-package runtime reproduction was performed.

Runtime and platform

Inspection host: Node v26.12.0, Darwin 27.0.0, arm64. Affected branch: Windows x64. Windows runtime details: NOT_ENOUGH_INFO; no Windows host was exercised.

Target and artifact context

No APK, Java executable fixture, or engine was opened or launched. The static input condition is a configured readable engine JAR, supported Windows native controls, JAVA_HOME absent, a current-directory java.exe, and a different JDK on PATH.

Interface

Package or setup

Earliest failure stage

Setup or provider admission

Relevant output or evidence

Source reads and Git comparisons established the evidence; no provider output was captured.

source HEAD: 3537e58c1ab29309f06eabf50bc52adba9817a0c
production-file diff from rea-agents-6.7.0: empty
Windows search order: process.cwd(), followed by PATH entries
first acceptable candidate: canonicalized and returned immediately

Lookup and return:583-597, Java probe command:113-134, and doctor admission:16-30 show that this is shared production configuration rather than a test-only helper.

Typed outcome or recovery expected

Resolve the PATH-selected JDK when JAVA_HOME is absent. Preserve the documented absolute JAVA_HOME override and existing typed prerequisite failures.

Analysis or suspected cause

Source-derived cause: the selector explicitly adds process.cwd() before PATH and has no fallback to the PATH JDK after the selected current-directory runtime fails validation. The absolute selected path then propagates unchanged into the prerequisite probe and session.

Additional context

Open and closed issue search found no report covering this Windows current-directory Java-selection contract. Stable coverage is source-only; real Windows admission, JDK probing, and engine lifecycle remain untested by this report.

Originally created by @coygeek on GitHub (Oct 18, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/5096 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area Setup, packaging, or upgrade ## Observed behavior SOURCE-ONLY: Windows JADX configuration prepends the process working directory to the selected PATH directories when JAVA_HOME is absent. It returns the first readable regular java.exe. Consequently, an unrelated current-directory java.exe wins over a different JDK selected through PATH, even when the current directory is absent from PATH. The production caller passes that selected path directly to the Java prerequisite probe and, after validation, the engine session. No Windows runtime or provider execution was performed. ## Reproduction Static verification performed against the source revision below: 1. Trace the supported APK caller in [JadxProvider.ts:435-446](https://github.com/morluto/rea/blob/3537e58c1ab29309f06eabf50bc52adba9817a0c/src/android/JadxProvider.ts#L435-L446) into [configuration resolution:239-280](https://github.com/morluto/rea/blob/3537e58c1ab29309f06eabf50bc52adba9817a0c/src/android/JadxConfiguration.ts#L239-L280). 2. Confirm [host admission:490-536](https://github.com/morluto/rea/blob/3537e58c1ab29309f06eabf50bc52adba9817a0c/src/android/JadxConfiguration.ts#L490-L536) permits Windows x64 with matching native controls and owned protocol stdin. 3. Inspect [Java lookup:576-623](https://github.com/morluto/rea/blob/3537e58c1ab29309f06eabf50bc52adba9817a0c/src/android/JadxConfiguration.ts#L576-L623). With JAVA_HOME absent, the candidate list begins with process.cwd(); the first acceptable java.exe returns immediately. 4. Confirm [validation:283-290](https://github.com/morluto/rea/blob/3537e58c1ab29309f06eabf50bc52adba9817a0c/src/android/JadxConfiguration.ts#L283-L290) probes configuration.java and [session creation:543-558](https://github.com/morluto/rea/blob/3537e58c1ab29309f06eabf50bc52adba9817a0c/src/android/JadxProvider.ts#L543-L558) uses it as the command. This establishes selection statically for an accessible current-directory java.exe and a distinct PATH JDK, with the current directory excluded from PATH. NOT_ENOUGH_INFO: no real Windows reproduction or frequency measurement. ## Expected behavior Use the selected Windows PATH when JAVA_HOME is absent, as described by the [Android setup guide:81-96](https://github.com/morluto/rea/blob/3537e58c1ab29309f06eabf50bc52adba9817a0c/docs/android-analysis.md#L81-L96). An unrelated working-directory file should not override that selection unless the caller includes its directory in PATH. ## Impact and scope Source-derived scope: supported Windows x64 JADX admission with JAVA_HOME absent and an accessible java.exe in the process working directory. The selected runtime can differ from the PATH JDK. An unusable current-directory runtime can fail admission despite a usable PATH JDK; a valid alternative runtime can pass validation and be used for the session. Neither consequence was executed on Windows, and real-world frequency is unknown. The documented workaround is to set an absolute JAVA_HOME. [The selector:622-623](https://github.com/morluto/rea/blob/3537e58c1ab29309f06eabf50bc52adba9817a0c/src/android/JadxConfiguration.ts#L622-L623) then returns its bin/java.exe without searching the working directory. No security impact is asserted. ## REA version Source 3537e58c1ab29309f06eabf50bc52adba9817a0c; package manifest 6.7.0. Current-main static verification only. Relevant production source is identical to the rea-agents-6.7.0 tag; no released-package runtime reproduction was performed. ## Runtime and platform Inspection host: Node v26.12.0, Darwin 27.0.0, arm64. Affected branch: Windows x64. Windows runtime details: NOT_ENOUGH_INFO; no Windows host was exercised. ## Target and artifact context No APK, Java executable fixture, or engine was opened or launched. The static input condition is a configured readable engine JAR, supported Windows native controls, JAVA_HOME absent, a current-directory java.exe, and a different JDK on PATH. ## Interface Package or setup ## Earliest failure stage Setup or provider admission ## Relevant output or evidence Source reads and Git comparisons established the evidence; no provider output was captured. ```text source HEAD: 3537e58c1ab29309f06eabf50bc52adba9817a0c production-file diff from rea-agents-6.7.0: empty Windows search order: process.cwd(), followed by PATH entries first acceptable candidate: canonicalized and returned immediately ``` [Lookup and return:583-597](https://github.com/morluto/rea/blob/3537e58c1ab29309f06eabf50bc52adba9817a0c/src/android/JadxConfiguration.ts#L583-L597), [Java probe command:113-134](https://github.com/morluto/rea/blob/3537e58c1ab29309f06eabf50bc52adba9817a0c/src/android/JadxJavaProbe.ts#L113-L134), and [doctor admission:16-30](https://github.com/morluto/rea/blob/3537e58c1ab29309f06eabf50bc52adba9817a0c/src/android/JadxDoctor.ts#L16-L30) show that this is shared production configuration rather than a test-only helper. ## Typed outcome or recovery expected Resolve the PATH-selected JDK when JAVA_HOME is absent. Preserve the documented absolute JAVA_HOME override and existing typed prerequisite failures. ## Analysis or suspected cause Source-derived cause: the selector explicitly adds process.cwd() before PATH and has no fallback to the PATH JDK after the selected current-directory runtime fails validation. The absolute selected path then propagates unchanged into the prerequisite probe and session. ## Additional context Open and closed issue search found no report covering this Windows current-directory Java-selection contract. Stable coverage is source-only; real Windows admission, JDK probing, and engine lifecycle remain untested by this report.

bsakaguchi closed this issue

2026-10-31 00:37:01 +00:00

bsakaguchi commented

2026-10-31 00:37:02 +00:00

Author

Owner

@XinwangTao commented on GitHub (Oct 19, 2026):

This is a real precedence bug — process.cwd() should never be an implicit java candidate when JAVA_HOME is unset; a stray java.exe dropped into the working directory can silently shadow the JDK the user deliberately selected via PATH. Windows also has the classic quirk that the current directory is not in the default DLL search path, which makes this even more surprising. Preferring an explicit JAVA_HOME → PATH order (and only falling back to cwd with a warning, or dropping cwd entirely) would make selection deterministic.

@XinwangTao commented on GitHub (Oct 19, 2026): This is a real precedence bug — process.cwd() should never be an implicit java candidate when JAVA_HOME is unset; a stray java.exe dropped into the working directory can silently shadow the JDK the user deliberately selected via PATH. Windows also has the classic quirk that the current directory is not in the default DLL search path, which makes this even more surprising. Preferring an explicit JAVA_HOME → PATH order (and only falling back to cwd with a warning, or dropping cwd entirely) would make selection deterministic.

bsakaguchi commented

2026-10-31 00:37:02 +00:00

Author

Owner

@coygeek commented on GitHub (Oct 24, 2026):

Checked resolved on main at d87e73f2db.

The source-only precedence defect reported here is resolved: the Windows Java selector now searches only the caller-selected PATH entries when JAVA_HOME is absent; it no longer prepends the process working directory. I evaluated the exact current selector function with Windows path semantics and isolated filesystem dependencies. Five controls passed: a quoted PATH JDK beats an accessible unrelated working-directory java.exe, a missing first PATH candidate advances to the next, absolute JAVA_HOME overrides PATH, empty PATH does not consult the working directory, and the working directory wins only when explicitly included in PATH. This verifies the selection owner without claiming a native Windows host, JDK probe or JADX engine run.

Relevant implementation: JadxConfiguration.ts, jadxConfiguration.test.ts.

Closing as completed on main.

@coygeek commented on GitHub (Oct 24, 2026): Checked resolved on `main` at d87e73f2db50be72d33a4b3c7199af35518b441c. The source-only precedence defect reported here is resolved: the Windows Java selector now searches only the caller-selected PATH entries when JAVA_HOME is absent; it no longer prepends the process working directory. I evaluated the exact current selector function with Windows path semantics and isolated filesystem dependencies. Five controls passed: a quoted PATH JDK beats an accessible unrelated working-directory java.exe, a missing first PATH candidate advances to the next, absolute JAVA_HOME overrides PATH, empty PATH does not consult the working directory, and the working directory wins only when explicitly included in PATH. This verifies the selection owner without claiming a native Windows host, JDK probe or JADX engine run. Relevant implementation: [JadxConfiguration.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/src/android/JadxConfiguration.ts#L598), [jadxConfiguration.test.ts](https://github.com/morluto/rea/blob/d87e73f2db50be72d33a4b3c7199af35518b441c/tests/boundary/android/jadxConfiguration.test.ts#L32). Closing as completed on main.

bsakaguchi referenced this issue

2026-11-01 21:10:53 +00:00

[GH-ISSUE #3582] [Tracker] Ready to close or merge: issues and pull requests (October 2026) #1330

bsakaguchi referenced this issue

2026-11-01 21:10:57 +00:00

[GH-ISSUE #3796] [Tracker] Open feature requests by area (October 2026) #1471

bsakaguchi referenced this issue

2026-11-01 21:43:50 +00:00

[PR #5349] [MERGED] perf(analysis-view): reuse validated immutable captures #6887

bsakaguchi referenced this issue

2026-11-03 23:47:04 +00:00

[GH-ISSUE #3133] test(perf): measure supported qlog summaries and retained event views #1093