[GH-ISSUE #1860] [Bug] Android engine admission rejects duplicate ZIP resource names in the audited JAR #632

New issue

Closed

opened 2026-10-15 18:26:48 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-10-15 18:26:48 +00:00

Owner

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026).
Original GitHub issue: https://github.com/morluto/rea/issues/1860

Before submitting

I searched open and closed issues and pull requests for related work.
I removed credentials, private paths, and sensitive target data.

Area

Provider or capability discovery; Evidence, artifacts, or reconstruction.

Observed behavior

REA rejects the audited Android engine JAR before starting its provider because ZIP inventory uses entry filenames as source identity. This real JAR contains repeated license-resource entries. The typed setup failure is capability_unavailable / unsupported_provider, with Artifact path collision: META-INF/LICENSE.txt.

Reproduction

Configure the caller-supplied audited Android engine JAR documented by REA.
Invoke inspect_android_package or inspect_android_method with a local APK.
Observe prerequisite rejection before provider analysis.

Expected behavior

Read physical ZIP member identities without overwriting another member that has the same filename. Engine metadata inventory should admit the audited JAR. Artifact workflows that require unique logical paths must continue to reject ambiguous duplicate paths at their owning validation boundary.

Impact and scope

All selected Android operations are blocked with this audited engine on the observed current main. No target execution or malformed APK is involved. This is a prerequisite to resolving #1846.

REA version

Current main ed1519ddee02739f57136e356786f64c7f74fed0.

Runtime and platform

Linux x86_64; Node.js 24.18.0; one CPU, 3 GiB process-tree limit.

Target and artifact context

A ZIP/JAR engine archive containing repeated META-INF/LICENSE, META-INF/LICENSE.txt, and LICENSE records.

Interface

CLI; shared provider configuration used by MCP.

Earliest failure stage

Setup or provider admission.

Analysis or suspected cause

src/android/JadxConfiguration.ts inventories prerequisites through ZipArtifactReader. That reader rejects repeated filenames and keys source entries by path. Distinguish physical archive-entry identity from logical artifact-path uniqueness; preserve both original entries and the existing extraction/path safety contract.

Typed outcome or recovery expected

Valid audited engine admission; malformed archives, metadata budgets, encrypted required entries, target identity and cancellation checks remain enforced.

Originally created by @N0zoM1z0 on GitHub (Oct 11, 2026). Original GitHub issue: https://github.com/morluto/rea/issues/1860 ### Before submitting - [x] I searched open and closed issues and pull requests for related work. - [x] I removed credentials, private paths, and sensitive target data. ### Area Provider or capability discovery; Evidence, artifacts, or reconstruction. ### Observed behavior REA rejects the audited Android engine JAR before starting its provider because ZIP inventory uses entry filenames as source identity. This real JAR contains repeated license-resource entries. The typed setup failure is `capability_unavailable` / `unsupported_provider`, with `Artifact path collision: META-INF/LICENSE.txt`. ### Reproduction 1. Configure the caller-supplied audited Android engine JAR documented by REA. 2. Invoke `inspect_android_package` or `inspect_android_method` with a local APK. 3. Observe prerequisite rejection before provider analysis. ### Expected behavior Read physical ZIP member identities without overwriting another member that has the same filename. Engine metadata inventory should admit the audited JAR. Artifact workflows that require unique logical paths must continue to reject ambiguous duplicate paths at their owning validation boundary. ### Impact and scope All selected Android operations are blocked with this audited engine on the observed current main. No target execution or malformed APK is involved. This is a prerequisite to resolving #1846. ### REA version Current main `ed1519ddee02739f57136e356786f64c7f74fed0`. ### Runtime and platform Linux x86_64; Node.js 24.18.0; one CPU, 3 GiB process-tree limit. ### Target and artifact context A ZIP/JAR engine archive containing repeated `META-INF/LICENSE`, `META-INF/LICENSE.txt`, and `LICENSE` records. ### Interface CLI; shared provider configuration used by MCP. ### Earliest failure stage Setup or provider admission. ### Analysis or suspected cause `src/android/JadxConfiguration.ts` inventories prerequisites through `ZipArtifactReader`. That reader rejects repeated filenames and keys source entries by path. Distinguish physical archive-entry identity from logical artifact-path uniqueness; preserve both original entries and the existing extraction/path safety contract. ### Typed outcome or recovery expected Valid audited engine admission; malformed archives, metadata budgets, encrypted required entries, target identity and cancellation checks remain enforced.

bsakaguchi

2026-10-15 18:26:48 +00:00