morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[GH-ISSUE #7376] [Bug] Byte-entropy CLI accepts empty and non-decimal window options #4385

New issue

Open

opened 2026-10-31 00:49:24 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 00:49:24 +00:00

Owner

Originally created by @coygeek on GitHub (Oct 27, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/7376

Before submitting

I searched the open and closed issues for a related report.
I removed credentials, tokens, private paths, and sensitive target data.

Area

CLI

Observed behavior

inspect-byte-entropy <file> --length= succeeds with a zero-byte selected window and no blocks. Omitting length inspects the whole 256-byte fixture. The command also accepts --offset= as zero, --offset=0x10 as 16, and --offset=1e2 as 100, despite advertising decimal byte counts.

Reproduction

Use Node.js 24.22.1 at the source revision below. A fresh checkout needs npm ci && npm run build:cached; verification reused installed locked dependencies, confirmed the lockfile was unchanged, and ran npm run build:cached. Run from the repository root:

WORK="$(mktemp -d)"
mkdir -p "$WORK"/{home,config,data,cache,state,temp}
export HOME="$WORK/home" XDG_CONFIG_HOME="$WORK/config" XDG_DATA_HOME="$WORK/data"
export XDG_CACHE_HOME="$WORK/cache" XDG_STATE_HOME="$WORK/state" TMPDIR="$WORK/temp"
python3 -c 'import pathlib,sys; pathlib.Path(sys.argv[1]).write_bytes(bytes(range(256)))' "$WORK/sample.bin"
for option in --length= omitted --offset= --offset=0x10 --offset=1e2 --block-size=; do
  printf 'case=%s\n' "$option"
  if [ "$option" = omitted ]; then
    node scripts/rea.mjs inspect-byte-entropy "$WORK/sample.bin" --json --filter-output 'parameters.length,parameters.offset,normalized_result.window,normalized_result.blocks'
  else
    node scripts/rea.mjs inspect-byte-entropy "$WORK/sample.bin" "$option" --json --filter-output 'parameters.length,parameters.offset,normalized_result.window,normalized_result.blocks'
  fi
  printf 'exit=%s\n' "$?"
done

Each listed case ran twice with the same results. Separate controls using --length 0 and --offset 16 --length 16 each succeeded once.

Expected behavior

Reject explicitly empty numeric window values and non-decimal offsets with a nonzero status and a validation error naming the flag. Preserve valid numeric zero and omitted-length semantics. Expected source: docs/binary-diagnostics.md:303-310 specifies decimal byte counts, omitted length through EOF, and accepted empty windows; src/cli/binaryDiagnosticsCommands.ts:209-214 advertises decimal offset and numeric length. An empty window is supported, but an empty string is not a decimal byte count.

Impact and scope

P2: a script passing an empty length variable gets successful empty selected-block evidence instead of an input error. The file-wide hash and entropy still cover the whole file; this concerns the selected window and blocks. Valid decimal values and omission of length are demonstrated workarounds. Observations cover this CLI command on one platform; other commands and MCP parsing were not tested. No security boundary crossing was observed.

REA version

Exact node scripts/rea.mjs --version output: 6.8.0. Source commit: 0e17aab45196eb298e761f9ed0e846404e01eefa.

Runtime and platform

Node.js v24.22.1; macOS 27.0.1; arm64.

Target and artifact context

A synthetic regular file containing bytes 0 through 255 once, totaling 256 bytes. Static file inspection; no target execution or external analysis provider.

Interface

CLI

Earliest failure stage

Request parsing or validation

Relevant output or evidence

Observed public CLI results, reduced to relevant fields:

Option	Exit	Selected window	Blocks
`--length=`	0	`{"offset":0,"length":0}`	`[]`
length omitted	0	`{"offset":0,"length":256}`	one block, entropy 8
`--offset=`	0	`{"offset":0,"length":256}`	one block
`--offset=0x10`	0	`{"offset":16,"length":240}`	one block
`--offset=1e2`	0	`{"offset":100,"length":156}`	one block
`--block-size=`	1	no result	`VALIDATION_ERROR`, field `blockSize`, minimum 256

Failure source: src/cli/binaryDiagnosticsCommands.ts:205-214 passes numeric domain schemas directly to CLI parsing; src/domain/native/byteEntropy.ts:4-25 permits numeric zero. The observed successful outputs establish the lost distinction between empty tokens, omission, and decimal tokens. Evidence provenance: observed. Local verification: reproduced. Reproduction completeness: complete. All invocations had empty stderr.

Typed outcome or recovery expected

A field-specific CLI validation failure before window inspection. A proposed restoration check is to reject the four invalid tokens above while preserving omitted length, explicit zero length, decimal offset/length, and the existing block-size failure. No repaired build was tested.

Analysis or suspected cause

Source-derived: the locked Incur parser applies Number(value) to numeric schema fields before validation (node_modules/incur/src/Parser.ts:322-330); empty text becomes zero and hex/exponent text loses its syntax. The service then treats that zero as an explicit length (src/application/binaryDiagnostics/ByteEntropyService.ts:214). REA already has a decimal-token helper at src/cli/options.ts:16-21. The block-size control rejects the resulting numeric zero for being too small; it does not establish lexical validation.

Additional context

Related open #7093 and PR #7092 concern environment-serve listener flags; their acceptance criteria do not cover byte windows. Closed #6482 and merged PR #6495 concern attribution of out-of-range window errors, rather than acceptance of malformed tokens. No exact duplicate was found. The first affected version is unknown.

Triage assessment

Impact level: P2
Assessment status: supported
Impact basis: Empty length silently returns a successful zero-byte selected window, and non-decimal offsets bypass the documented syntax; no data loss or severe downstream incident was observed.
Workaround status: available
Workaround basis: Omitting length scanned all 256 fixture bytes, and explicit decimal offset 16 with length 16 returned the requested window.

Originally created by @coygeek on GitHub (Oct 27, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/7376 ## Before submitting - [x] I searched the open and closed issues for a related report. - [x] I removed credentials, tokens, private paths, and sensitive target data. ## Area CLI ## Observed behavior `inspect-byte-entropy <file> --length=` succeeds with a zero-byte selected window and no blocks. Omitting length inspects the whole 256-byte fixture. The command also accepts `--offset=` as zero, `--offset=0x10` as 16, and `--offset=1e2` as 100, despite advertising decimal byte counts. ## Reproduction Use Node.js 24.22.1 at the source revision below. A fresh checkout needs `npm ci && npm run build:cached`; verification reused installed locked dependencies, confirmed the lockfile was unchanged, and ran `npm run build:cached`. Run from the repository root: ```sh WORK="$(mktemp -d)" mkdir -p "$WORK"/{home,config,data,cache,state,temp} export HOME="$WORK/home" XDG_CONFIG_HOME="$WORK/config" XDG_DATA_HOME="$WORK/data" export XDG_CACHE_HOME="$WORK/cache" XDG_STATE_HOME="$WORK/state" TMPDIR="$WORK/temp" python3 -c 'import pathlib,sys; pathlib.Path(sys.argv[1]).write_bytes(bytes(range(256)))' "$WORK/sample.bin" for option in --length= omitted --offset= --offset=0x10 --offset=1e2 --block-size=; do printf 'case=%s\n' "$option" if [ "$option" = omitted ]; then node scripts/rea.mjs inspect-byte-entropy "$WORK/sample.bin" --json --filter-output 'parameters.length,parameters.offset,normalized_result.window,normalized_result.blocks' else node scripts/rea.mjs inspect-byte-entropy "$WORK/sample.bin" "$option" --json --filter-output 'parameters.length,parameters.offset,normalized_result.window,normalized_result.blocks' fi printf 'exit=%s\n' "$?" done ``` Each listed case ran twice with the same results. Separate controls using `--length 0` and `--offset 16 --length 16` each succeeded once. ## Expected behavior Reject explicitly empty numeric window values and non-decimal offsets with a nonzero status and a validation error naming the flag. Preserve valid numeric zero and omitted-length semantics. Expected source: `docs/binary-diagnostics.md:303-310` specifies decimal byte counts, omitted length through EOF, and accepted empty windows; `src/cli/binaryDiagnosticsCommands.ts:209-214` advertises decimal offset and numeric length. An empty window is supported, but an empty string is not a decimal byte count. ## Impact and scope P2: a script passing an empty length variable gets successful empty selected-block evidence instead of an input error. The file-wide hash and entropy still cover the whole file; this concerns the selected window and blocks. Valid decimal values and omission of length are demonstrated workarounds. Observations cover this CLI command on one platform; other commands and MCP parsing were not tested. No security boundary crossing was observed. ## REA version Exact `node scripts/rea.mjs --version` output: `6.8.0`. Source commit: `0e17aab45196eb298e761f9ed0e846404e01eefa`. ## Runtime and platform Node.js v24.22.1; macOS 27.0.1; arm64. ## Target and artifact context A synthetic regular file containing bytes 0 through 255 once, totaling 256 bytes. Static file inspection; no target execution or external analysis provider. ## Interface CLI ## Earliest failure stage Request parsing or validation ## Relevant output or evidence Observed public CLI results, reduced to relevant fields: | Option | Exit | Selected window | Blocks | | --- | --- | --- | --- | | `--length=` | 0 | `{"offset":0,"length":0}` | `[]` | | length omitted | 0 | `{"offset":0,"length":256}` | one block, entropy 8 | | `--offset=` | 0 | `{"offset":0,"length":256}` | one block | | `--offset=0x10` | 0 | `{"offset":16,"length":240}` | one block | | `--offset=1e2` | 0 | `{"offset":100,"length":156}` | one block | | `--block-size=` | 1 | no result | `VALIDATION_ERROR`, field `blockSize`, minimum 256 | Failure source: `src/cli/binaryDiagnosticsCommands.ts:205-214` passes numeric domain schemas directly to CLI parsing; `src/domain/native/byteEntropy.ts:4-25` permits numeric zero. The observed successful outputs establish the lost distinction between empty tokens, omission, and decimal tokens. Evidence provenance: observed. Local verification: reproduced. Reproduction completeness: complete. All invocations had empty stderr. ## Typed outcome or recovery expected A field-specific CLI validation failure before window inspection. A proposed restoration check is to reject the four invalid tokens above while preserving omitted length, explicit zero length, decimal offset/length, and the existing block-size failure. No repaired build was tested. ## Analysis or suspected cause Source-derived: the locked Incur parser applies `Number(value)` to numeric schema fields before validation (`node_modules/incur/src/Parser.ts:322-330`); empty text becomes zero and hex/exponent text loses its syntax. The service then treats that zero as an explicit length (`src/application/binaryDiagnostics/ByteEntropyService.ts:214`). REA already has a decimal-token helper at `src/cli/options.ts:16-21`. The block-size control rejects the resulting numeric zero for being too small; it does not establish lexical validation. ## Additional context Related open [#7093](https://github.com/morluto/rea/issues/7093) and [PR #7092](https://github.com/morluto/rea/pull/7092) concern environment-serve listener flags; their acceptance criteria do not cover byte windows. Closed [#6482](https://github.com/morluto/rea/issues/6482) and merged [PR #6495](https://github.com/morluto/rea/pull/6495) concern attribution of out-of-range window errors, rather than acceptance of malformed tokens. No exact duplicate was found. The first affected version is unknown. ## Triage assessment - Impact level: P2 - Assessment status: supported - Impact basis: Empty length silently returns a successful zero-byte selected window, and non-decimal offsets bypass the documented syntax; no data loss or severe downstream incident was observed. - Workaround status: available - Workaround basis: Omitting length scanned all 256 fixture bytes, and explicit decimal offset 16 with length 16 returned the requested window.

bsakaguchi referenced this issue

2026-10-31 01:12:49 +00:00

[PR #4413] [MERGED] fix(browser): retain bundle default origin scope #6224

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#4385

No description provided.

Rows
Columns