[PR #3659] fix(security): harden archive and Hopper probes #5868

New issue

Open

opened 2026-10-31 01:10:03 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-31 01:10:03 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/3659
Author: @Sunil56224972
Created: 10/14/2026
Status: 🔄 Open

Base: main ← Head: security/zip-reader-bounds-and-hopper-probe

📝 Commits (4)

b6ff40d fix(security): harden archive and Hopper probes
ed35bd5 style: format security patch
4cebcd9 Merge remote-tracking branch 'origin/main' into sweep/3659
7c3e816 fix(android): support pinned JADX archive size

📊 Changes

18 files changed (+388 additions, -85 deletions)

View changed files

📝 docs/android-analysis.md (+4 -3)
📝 docs/installation.md (+11 -6)
📝 src/android/JadxConfiguration.ts (+12 -5)
📝 src/application/Doctor.ts (+3 -18)
📝 src/application/LinuxHopper.test.ts (+2 -20)
📝 src/application/LinuxHopper.ts (+2 -12)
📝 src/artifacts/ZipArtifactReader.ts (+39 -6)
📝 src/browser/history/SazCapture.ts (+1 -5)
➕ src/domain/zipArtifactBudget.ts (+12 -0)
📝 src/flutter/FlutterBuildProvider.ts (+3 -3)
📝 tests/boundary/android/jadxConfiguration.test.ts (+38 -0)
➕ tests/boundary/browser/sazMetadataBudget.test.ts (+37 -0)
📝 tests/boundary/cli/doctorHopperDiscovery.test.ts (+4 -2)
➕ tests/boundary/filesystem/artifactInventoryLimits.test.ts (+106 -0)
➕ tests/boundary/filesystem/artifactZipCompleteness.test.ts (+42 -0)
📝 tests/boundary/filesystem/doctorSystemHostFilesystem.test.ts (+16 -5)
➕ tests/boundary/filesystem/linuxHopperLauncherStatus.test.ts (+50 -0)
➕ tests/fixtures/android/jadxArchiveMetadata.ts (+6 -0)

📄 Description

Findings

ZIP resource exhaustion: ZIP metadata reads are capped at 8 MiB and normal traversals at 4,096 entries.
ZIP inventory evasion: the reader validates the complete central-directory record count before yielding entries, so a misleading EOCD count cannot hide later paths.
Linux Hopper probe hardening: Doctor and install-status checks no longer pass the configured launcher to ldd. The marker-based regression proves that probe is not invoked; it does not claim arbitrary code execution by a malicious ELF.
JADX readiness compatibility: the pinned jadx-headless-mcp 0.7.1 JAR has 23,368 directory entries and a 2,294,350-byte central directory. The shared 4,096-entry limit remains unchanged; only selected engine archives use a separate 32,768-entry limit. The 8 MiB metadata cap remains in force.

Regression Tests

artifactInventoryLimits.test.ts retains the 4,097-entry inventory rejection and the over-8-MiB metadata rejection. It also generates a 23,368-entry ZIP: the default reader rejects before yielding, while the explicit engine budget reads every entry.
jadxConfiguration.test.ts ties recorded metadata to the pinned release version and SHA-256, checks both budgets, and verifies readiness with a synthetic JAR at the pinned entry count. The checked-in metadata records SHA-256 6e5eacf500b64292bfb73c49797c1958f6ee44646e43e868039ae7feb573ff75, 23,368 entries, and 2,294,350 central-directory bytes; tests do not download or execute JADX.
artifactZipCompleteness.test.ts rewrites the EOCD count while retaining a hidden entry and expects an integrity failure from inventory and early-exit traversal.
sazMetadataBudget.test.ts verifies rejection of a SAZ central directory exceeding 8 MiB.
doctorHopperDiscovery.test.ts uses a fake ldd marker to verify Doctor does not invoke the launcher probe; linuxHopperLauncherStatus.test.ts covers launcher status.

Validation

npm run test:focused -- tests/boundary/android/jadxConfiguration.test.ts tests/boundary/filesystem/artifactInventoryLimits.test.ts: 3 passed; 12 Android configuration tests skipped by the Windows platform guard. The portable 23,368-entry ZIP regression ran and passed.
npm run check:fast, npm run docs:check, and oxfmt --check on the changed files passed. The pre-push check:fast also passed.
GitHub Actions for updated head 7c3e816 passed: all five test shards, portable tests, static checks, package build, docs generation, browser/network checks, Linux package baseline, and the required CI gate.

Real-provider scope: these tests verify ZIP limits and JADX readiness, not a real JADX analysis run. The local Windows host also cannot run the Linux-only Hopper marker test.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/3659 **Author:** [@Sunil56224972](https://github.com/Sunil56224972) **Created:** 10/14/2026 **Status:** 🔄 Open **Base:** `main` ← **Head:** `security/zip-reader-bounds-and-hopper-probe` --- ### 📝 Commits (4) - [`b6ff40d`](https://github.com/morluto/rea/commit/b6ff40d09f9b41a4e10c481b9bb6742ea6357158) fix(security): harden archive and Hopper probes - [`ed35bd5`](https://github.com/morluto/rea/commit/ed35bd55440b432a4815b05167ef3d00809f3f4f) style: format security patch - [`4cebcd9`](https://github.com/morluto/rea/commit/4cebcd965c40a0f8fc8ca2f61e1ce3325ebe04da) Merge remote-tracking branch 'origin/main' into sweep/3659 - [`7c3e816`](https://github.com/morluto/rea/commit/7c3e8167c8624777f25be3a70627ac36c06ece5a) fix(android): support pinned JADX archive size ### 📊 Changes **18 files changed** (+388 additions, -85 deletions) <details> <summary>View changed files</summary> 📝 `docs/android-analysis.md` (+4 -3) 📝 `docs/installation.md` (+11 -6) 📝 `src/android/JadxConfiguration.ts` (+12 -5) 📝 `src/application/Doctor.ts` (+3 -18) 📝 `src/application/LinuxHopper.test.ts` (+2 -20) 📝 `src/application/LinuxHopper.ts` (+2 -12) 📝 `src/artifacts/ZipArtifactReader.ts` (+39 -6) 📝 `src/browser/history/SazCapture.ts` (+1 -5) ➕ `src/domain/zipArtifactBudget.ts` (+12 -0) 📝 `src/flutter/FlutterBuildProvider.ts` (+3 -3) 📝 `tests/boundary/android/jadxConfiguration.test.ts` (+38 -0) ➕ `tests/boundary/browser/sazMetadataBudget.test.ts` (+37 -0) 📝 `tests/boundary/cli/doctorHopperDiscovery.test.ts` (+4 -2) ➕ `tests/boundary/filesystem/artifactInventoryLimits.test.ts` (+106 -0) ➕ `tests/boundary/filesystem/artifactZipCompleteness.test.ts` (+42 -0) 📝 `tests/boundary/filesystem/doctorSystemHostFilesystem.test.ts` (+16 -5) ➕ `tests/boundary/filesystem/linuxHopperLauncherStatus.test.ts` (+50 -0) ➕ `tests/fixtures/android/jadxArchiveMetadata.ts` (+6 -0) </details> ### 📄 Description ## Findings - **ZIP resource exhaustion:** ZIP metadata reads are capped at 8 MiB and normal traversals at 4,096 entries. - **ZIP inventory evasion:** the reader validates the complete central-directory record count before yielding entries, so a misleading EOCD count cannot hide later paths. - **Linux Hopper probe hardening:** Doctor and install-status checks no longer pass the configured launcher to `ldd`. The marker-based regression proves that probe is not invoked; it does not claim arbitrary code execution by a malicious ELF. - **JADX readiness compatibility:** the pinned `jadx-headless-mcp` 0.7.1 JAR has 23,368 directory entries and a 2,294,350-byte central directory. The shared 4,096-entry limit remains unchanged; only selected engine archives use a separate 32,768-entry limit. The 8 MiB metadata cap remains in force. ## Regression Tests - [`artifactInventoryLimits.test.ts`](https://github.com/Sunil56224972/rea/blob/7c3e8167c8624777f25be3a70627ac36c06ece5a/tests/boundary/filesystem/artifactInventoryLimits.test.ts) retains the 4,097-entry inventory rejection and the over-8-MiB metadata rejection. It also generates a 23,368-entry ZIP: the default reader rejects before yielding, while the explicit engine budget reads every entry. - [`jadxConfiguration.test.ts`](https://github.com/Sunil56224972/rea/blob/7c3e8167c8624777f25be3a70627ac36c06ece5a/tests/boundary/android/jadxConfiguration.test.ts) ties recorded metadata to the pinned release version and SHA-256, checks both budgets, and verifies readiness with a synthetic JAR at the pinned entry count. The checked-in metadata records SHA-256 `6e5eacf500b64292bfb73c49797c1958f6ee44646e43e868039ae7feb573ff75`, 23,368 entries, and 2,294,350 central-directory bytes; tests do not download or execute JADX. - [`artifactZipCompleteness.test.ts`](https://github.com/Sunil56224972/rea/blob/7c3e8167c8624777f25be3a70627ac36c06ece5a/tests/boundary/filesystem/artifactZipCompleteness.test.ts) rewrites the EOCD count while retaining a hidden entry and expects an integrity failure from inventory and early-exit traversal. - [`sazMetadataBudget.test.ts`](https://github.com/Sunil56224972/rea/blob/7c3e8167c8624777f25be3a70627ac36c06ece5a/tests/boundary/browser/sazMetadataBudget.test.ts) verifies rejection of a SAZ central directory exceeding 8 MiB. - [`doctorHopperDiscovery.test.ts`](https://github.com/Sunil56224972/rea/blob/7c3e8167c8624777f25be3a70627ac36c06ece5a/tests/boundary/cli/doctorHopperDiscovery.test.ts) uses a fake `ldd` marker to verify Doctor does not invoke the launcher probe; [`linuxHopperLauncherStatus.test.ts`](https://github.com/Sunil56224972/rea/blob/7c3e8167c8624777f25be3a70627ac36c06ece5a/tests/boundary/filesystem/linuxHopperLauncherStatus.test.ts) covers launcher status. ## Validation - `npm run test:focused -- tests/boundary/android/jadxConfiguration.test.ts tests/boundary/filesystem/artifactInventoryLimits.test.ts`: 3 passed; 12 Android configuration tests skipped by the Windows platform guard. The portable 23,368-entry ZIP regression ran and passed. - `npm run check:fast`, `npm run docs:check`, and `oxfmt --check` on the changed files passed. The pre-push `check:fast` also passed. - GitHub Actions for updated head `7c3e816` passed: all five test shards, portable tests, static checks, package build, docs generation, browser/network checks, Linux package baseline, and the required CI gate. Real-provider scope: these tests verify ZIP limits and JADX readiness, not a real JADX analysis run. The local Windows host also cannot run the Linux-only Hopper marker test. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi added the

pull-request

label

2026-10-31 01:10:03 +00:00

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

morluto/rea#5868

No description provided.

Rows
Columns