morluto/rea

Fork 0

mirror of https://github.com/morluto/rea.git synced 2026-11-05 06:45:22 +00:00

[PR #2384] [MERGED] fix(formats): preserve high bits in remaining magic-byte checks #5196

New issue

Closed

opened 2026-10-31 01:04:43 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:04:43 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/2384
Author: @lusknchars
Created: 10/12/2026
Status: ✅ Merged
Merged: 10/13/2026
Merged by: @morluto

Base: main ← Head: fix/latin1-format-signatures

📝 Commits (3)

6bb2e11 fix(formats): preserve high bits in remaining magic-byte checks
20591eb chore: merge main into exact format signature fixes
2a434a7 style(windows): format signature admission regressions

📊 Changes

5 files changed (+41 additions, -6 deletions)

View changed files

📝 scripts/verify-windows-native-artifact.mjs (+2 -2)
📝 src/domain/native/nativeAotPe.test.ts (+19 -0)
📝 src/domain/native/nativeAotPe.ts (+2 -2)
📝 src/windows/WindowsNativeLoader.test.ts (+16 -0)
📝 src/windows/WindowsNativeLoader.ts (+2 -2)

📄 Description

Summary

Follow-up to #2343 / ac57c88ef. That fix changed the shared DOS/MZ reader from toString("ascii") to toString("latin1") because Node's "ascii" decoder masks the high bit. The same pattern remained in 14 other magic-byte checks. Each one accepts a lookalike such as CD DA as "MZ", or a high-bit bplist00 / NIBArchive header as the real format.

Problem and expected behavior

Smallest trigger: a NativeAOT candidate whose first two bytes are CD DA ("MZ" | 0x80). parseNativeAotPe admits it as a PE and only fails later. Likewise, a keyed-archive input starting with "NIBArchive" with the high bit set on each byte is refused as a compiled NIB (KeyedArchiveKindError: nib-archive), when it is just malformed XML/plist input.

Violated invariant (same as #2343): only the exact signature bytes identify a format.

Change and scope

"ascii" → "latin1" in signature comparisons only, matching ac57c88ef:

src/domain/native/nativeAotPe.ts: MZ, PE\0\0
src/windows/WindowsNativeLoader.ts: MZ, PE\0\0
src/artifacts/apple/{KeyedArchiveReader,InterfaceBuilderAnalysis,InterfaceBuilderDecodeBudget,PlistNumberLiterals}.ts, src/application/AppBundleExecutable.ts: bplist00 / bplist / NIBArchive
src/browser/CdpScreenshot.ts, src/domain/native/nativeUiObservation.ts: PNG IHDR

Intentionally not included: three decodes that produce display names, not signature decisions (AppleMachoSelection section names, ManagedMetadataLayout stream names, nativeAotPe section names). Changing them alters output text, so they'd be better as a separate change if wanted.

Contribution scope: not applicable (an ordinary fix within existing boundaries).

Contract and boundary impact

Semantic owner and earliest changed stage: each format reader's signature check (the earliest stage)
Contribution scope fit and linked maintainer decision: not applicable
CLI and MCP/tool-catalog contract: none
Provider, bridge, target-format, or platform compatibility: valid inputs are unchanged; only high-bit lookalikes are now refused at the signature check
Evidence, artifact, provenance, or reconstruction contract: none
Target selection, authority, upstream behavior, and cleanup details: not applicable
Generated metadata, package, or installation impact: none
Read existing files or captured data.

Evidence and regression coverage

Tests added or updated:
- nativeAotPe.test.ts: high-bit lookalikes of MZ and PE are not_applicable with the right reason
- KeyedArchiveReader.test.ts: real NIBArchive is still refused as a NIB; high-bit NIBArchive / bplist00 fall through to plist text decoding
Base reproduction: with the source changes reverted on 91b8f587c, all 3 new tests fail (3 failed | 26 passed); with the change applied, they pass.
Remaining proof gaps: no dedicated regression tests for the Windows loader, PNG IHDR, or app-bundle plist sites (same one-token change, covered by their existing tests). Windows loader not exercised on real Windows.

Validation performed

npm run check:fast — typecheck + lint pass (macOS arm64, Node 24.15)
npx oxfmt --check <changed files> — pass
npm run test:fast — 412 files, 5357 passed, 7 skipped
npx vitest run src/artifacts/apple src/domain/native src/windows/WindowsNativeLoader.test.ts tests/boundary/filesystem/{interfaceBuilderBundle,appleXmlDeclarations,nibNativeHierarchy,binaryTarget}.test.ts tests/boundary/providers/native/keyedArchiveEncoding.test.ts (after build:cached + test:prepare) — 18 files, 292 passed

Compatibility, safety, and release

Breaking changes or migration steps: none
Real Hopper/Ghidra, browser, or OS coverage: none needed; macOS only for local runs
Package or release metadata impact: none
Security, privacy, process, or containment review: tightens input admission only

🤖 Generated with Claude Code

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/2384 **Author:** [@lusknchars](https://github.com/lusknchars) **Created:** 10/12/2026 **Status:** ✅ Merged **Merged:** 10/13/2026 **Merged by:** [@morluto](https://github.com/morluto) **Base:** `main` ← **Head:** `fix/latin1-format-signatures` --- ### 📝 Commits (3) - [`6bb2e11`](https://github.com/morluto/rea/commit/6bb2e11a1e24eb2fd1387d4dee851999715225a3) fix(formats): preserve high bits in remaining magic-byte checks - [`20591eb`](https://github.com/morluto/rea/commit/20591ebe9b572c3b0bff670ddccd3ca1501b8c3d) chore: merge main into exact format signature fixes - [`2a434a7`](https://github.com/morluto/rea/commit/2a434a7efee988085edf124c818c328ebec04e19) style(windows): format signature admission regressions ### 📊 Changes **5 files changed** (+41 additions, -6 deletions) <details> <summary>View changed files</summary> 📝 `scripts/verify-windows-native-artifact.mjs` (+2 -2) 📝 `src/domain/native/nativeAotPe.test.ts` (+19 -0) 📝 `src/domain/native/nativeAotPe.ts` (+2 -2) 📝 `src/windows/WindowsNativeLoader.test.ts` (+16 -0) 📝 `src/windows/WindowsNativeLoader.ts` (+2 -2) </details> ### 📄 Description ## Summary Follow-up to #2343 / ac57c88ef. That fix changed the shared DOS/MZ reader from `toString("ascii")` to `toString("latin1")` because Node's `"ascii"` decoder masks the high bit. The same pattern remained in 14 other magic-byte checks. Each one accepts a lookalike such as `CD DA` as `"MZ"`, or a high-bit `bplist00` / `NIBArchive` header as the real format. ## Problem and expected behavior Smallest trigger: a NativeAOT candidate whose first two bytes are `CD DA` (`"MZ" | 0x80`). `parseNativeAotPe` admits it as a PE and only fails later. Likewise, a keyed-archive input starting with `"NIBArchive"` with the high bit set on each byte is refused as a compiled NIB (`KeyedArchiveKindError: nib-archive`), when it is just malformed XML/plist input. Violated invariant (same as #2343): only the exact signature bytes identify a format. ## Change and scope `"ascii"` → `"latin1"` in signature comparisons only, matching ac57c88ef: - `src/domain/native/nativeAotPe.ts`: `MZ`, `PE\0\0` - `src/windows/WindowsNativeLoader.ts`: `MZ`, `PE\0\0` - `src/artifacts/apple/{KeyedArchiveReader,InterfaceBuilderAnalysis,InterfaceBuilderDecodeBudget,PlistNumberLiterals}.ts`, `src/application/AppBundleExecutable.ts`: `bplist00` / `bplist` / `NIBArchive` - `src/browser/CdpScreenshot.ts`, `src/domain/native/nativeUiObservation.ts`: PNG `IHDR` Intentionally not included: three decodes that produce display names, not signature decisions (`AppleMachoSelection` section names, `ManagedMetadataLayout` stream names, `nativeAotPe` section names). Changing them alters output text, so they'd be better as a separate change if wanted. Contribution scope: not applicable (an ordinary fix within existing boundaries). ## Contract and boundary impact - Semantic owner and earliest changed stage: each format reader's signature check (the earliest stage) - Contribution scope fit and linked maintainer decision: not applicable - CLI and MCP/tool-catalog contract: none - Provider, bridge, target-format, or platform compatibility: valid inputs are unchanged; only high-bit lookalikes are now refused at the signature check - Evidence, artifact, provenance, or reconstruction contract: none - Target selection, authority, upstream behavior, and cleanup details: not applicable - Generated metadata, package, or installation impact: none - [x] Read existing files or captured data. ## Evidence and regression coverage - Tests added or updated: - `nativeAotPe.test.ts`: high-bit lookalikes of `MZ` and `PE` are `not_applicable` with the right reason - `KeyedArchiveReader.test.ts`: real `NIBArchive` is still refused as a NIB; high-bit `NIBArchive` / `bplist00` fall through to plist text decoding - Base reproduction: with the source changes reverted on 91b8f587c, all 3 new tests fail (`3 failed | 26 passed`); with the change applied, they pass. - Remaining proof gaps: no dedicated regression tests for the Windows loader, PNG `IHDR`, or app-bundle plist sites (same one-token change, covered by their existing tests). Windows loader not exercised on real Windows. ## Validation performed - `npm run check:fast` — typecheck + lint pass (macOS arm64, Node 24.15) - `npx oxfmt --check <changed files>` — pass - `npm run test:fast` — 412 files, 5357 passed, 7 skipped - `npx vitest run src/artifacts/apple src/domain/native src/windows/WindowsNativeLoader.test.ts tests/boundary/filesystem/{interfaceBuilderBundle,appleXmlDeclarations,nibNativeHierarchy,binaryTarget}.test.ts tests/boundary/providers/native/keyedArchiveEncoding.test.ts` (after `build:cached` + `test:prepare`) — 18 files, 292 passed ## Compatibility, safety, and release - Breaking changes or migration steps: none - Real Hopper/Ghidra, browser, or OS coverage: none needed; macOS only for local runs - Package or release metadata impact: none - Security, privacy, process, or containment review: tightens input admission only 🤖 Generated with [Claude Code](https://claude.com/claude-code) --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-10-31 01:04:43 +00:00

closed this issue
added the
pull-request
label

bsakaguchi referenced this issue

2026-11-01 21:43:10 +00:00

[PR #5196] [MERGED] fix(javascript): match unchanged module exports across application versions #6808

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5196

No description provided.

Rows
Columns