[PR #5007] [CLOSED] fix(plist): match native data decoding #6726

Closed
opened 2026-11-01 21:42:36 +00:00 by bsakaguchi · 0 comments
Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5007
Author: @therahimulislam
Created: 10/18/2026
Status: ❌ Closed

Base: main ← Head: fix/4978-plist-data-decoding


📝 Commits (2)

  • bef1042 fix(plist): match native data decoding
  • 7f94894 fix(plist): preserve raw data spelling

📊 Changes

4 files changed (+67 additions, -10 deletions)

View changed files

📝 src/domain/propertyListXml.test.ts (+13 -0)
📝 src/domain/propertyListXml.ts (+10 -1)
📝 src/domain/xmlDocument.ts (+29 -9)
📝 src/native/parsers/plist.test.ts (+15 -0)

📄 Description

Summary

Fixes #4978

Commit: bef10426d

Make XML plist <data> decoding match the documented native CFPropertyList behavior while preserving the existing raw source and Evidence/projection paths.

Problem and expected behavior

The shared XML plist decoder previously removed whitespace and passed the remaining text directly to WHATWG atob. Native CFPropertyList drops non-alphabet characters before decoding and emits only complete Base64 quartets. As a result, AQI produced bytes where native conversion produces empty data, while AQ!ID failed even though native conversion accepts it.

The decoder now filters to Base64 alphabet characters and truncates incomplete trailing quartets before decoding. AQID, whitespace-separated A Q I D, incomplete AQI, punctuation-containing AQ!ID, and entity reference AQI&#33;D now match the native observations.

Change and scope

The fix is limited to the existing shared XML <data> decoding boundary in src/domain/propertyListXml.ts, with focused regression coverage at both the domain decoder and native XML projection consumer. The XML parser now retains raw <data> interiors from its source-position-aware validation pass, so entity references are filtered according to their native source spelling rather than their expanded DOM text. Raw XML source handling and existing Evidence/projection behavior remain unchanged.

Follow the contribution scope.
Unresolved scope, authority, side effects, or required verification block
integration. Link the required maintainer scope decision for new providers or
capabilities involving target execution, injection, mutation, or protection
recovery; ordinary fixes within existing boundaries may state "not applicable".
Draft PRs may leave the scope decision pending and the readiness and merge checklists
unchecked. Maintainers can help resolve open questions.

Contract and boundary impact

  • Semantic owner and earliest changed stage: Shared XML plist value decoding; <data> interpretation.
  • Contribution scope fit and linked maintainer decision: Existing runtime fix; maintainer scope decision not applicable.
  • CLI and MCP/tool-catalog contract: No contract or catalog changes.
  • Provider, bridge, target-format, or platform compatibility: Aligns XML plist data behavior with native CFPropertyList observations; no provider changes.
  • Evidence, artifact, provenance, or reconstruction contract: Existing raw source and projection/Evidence paths are preserved.
  • Target selection, authority, upstream behavior, and cleanup details (if applicable): Not applicable; no target execution or cleanup.
  • Generated metadata (docs/public/product-catalog.json), package, or installation impact (CI generates and validates ignored catalogs and skills/; edit authored instructions in .agents/skills/reverse-engineer-anything/ and never commit build outputs): None.

Expected effects (check known effects; use documentation-only on its own).
Unchecked items do not establish absence; leave uncertainties visible.

  • Read existing files or captured data.
  • Launch or attach to a process.
  • Inject instrumentation or run scripts/code.
  • Change process memory, registers, files, or configuration.
  • Contact network services.
  • Recover protected code or work around protections.
  • Documentation or usability only; no target interaction.
  • Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

  • Tests added or updated: Added shared decoder and native XML projection regressions for AQID, whitespace-separated A Q I D, incomplete AQI, punctuation-containing AQ!ID, and entity reference AQI&#33;D.
  • Base reproduction or other evidence: The issue's native plutil/Python plistlib observations establish AQID and A Q I D as 010203, AQI as empty data, and AQ!ID as 010203. The base decoder diverged for AQI and AQ!ID.
  • User-visible CLI/MCP output (if applicable): Existing projected data output remains the same shape, with corrected bytes for affected XML spellings.
  • Remaining proof gaps: Compiled boundary and real-provider workflows were not run.

For evidence-bearing changes:

  • Observed, derived, and inferred claims remain distinguishable.
  • Artifact identity, source provenance, and failed attempts remain preserved.
  • Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

  • npm run test:local -- src/domain/propertyListXml.test.ts src/native/parsers/plist.test.ts — passed, 56 tests.
  • npm run check:fast — passed, typecheck and lint.
  • npx oxfmt --check src/domain/propertyListXml.ts src/domain/propertyListXml.test.ts src/native/parsers/plist.test.ts — passed.
  • git diff --check — passed.

Compatibility, safety, and release

  • Breaking changes or migration steps: None; this corrects XML data bytes to match native behavior.
  • Real Hopper/Ghidra, browser, or OS coverage: Compiled boundary and real-provider workflows were not run.
  • Package or release metadata impact: None.
  • Security, privacy, process, or containment review: No target interaction, process execution, instrumentation, or sensitive-data handling was added.

Author readiness

Human owner:

  • I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
  • I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
  • I declare this PR ready for initial maintainer review.

Before merge

  • This PR addresses a concrete problem or an agreed enhancement.
  • Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
  • The PR has one focused outcome and the title follows type(scope): outcome.
  • Related issue is linked, or the reason for not linking one is stated above.
  • Tests cover changed observable behavior and meaningful failure paths.
  • Owning docs, contracts, and generated metadata are updated where needed.
  • User-visible CLI/MCP changes include representative output.
  • I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5007 **Author:** [@therahimulislam](https://github.com/therahimulislam) **Created:** 10/18/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/4978-plist-data-decoding` --- ### 📝 Commits (2) - [`bef1042`](https://github.com/morluto/rea/commit/bef10426d5127889131014490e8875fcbf6498f4) fix(plist): match native data decoding - [`7f94894`](https://github.com/morluto/rea/commit/7f94894e618e6721dedc4e34e992ddd99a4d7d6c) fix(plist): preserve raw data spelling ### 📊 Changes **4 files changed** (+67 additions, -10 deletions) <details> <summary>View changed files</summary> 📝 `src/domain/propertyListXml.test.ts` (+13 -0) 📝 `src/domain/propertyListXml.ts` (+10 -1) 📝 `src/domain/xmlDocument.ts` (+29 -9) 📝 `src/native/parsers/plist.test.ts` (+15 -0) </details> ### 📄 Description ## Summary Fixes #4978 Commit: `bef10426d` Make XML plist `<data>` decoding match the documented native `CFPropertyList` behavior while preserving the existing raw source and Evidence/projection paths. ## Problem and expected behavior The shared XML plist decoder previously removed whitespace and passed the remaining text directly to WHATWG `atob`. Native `CFPropertyList` drops non-alphabet characters before decoding and emits only complete Base64 quartets. As a result, `AQI` produced bytes where native conversion produces empty data, while `AQ!ID` failed even though native conversion accepts it. The decoder now filters to Base64 alphabet characters and truncates incomplete trailing quartets before decoding. `AQID`, whitespace-separated ` A Q I D`, incomplete `AQI`, punctuation-containing `AQ!ID`, and entity reference `AQI&#33;D` now match the native observations. ## Change and scope The fix is limited to the existing shared XML `<data>` decoding boundary in `src/domain/propertyListXml.ts`, with focused regression coverage at both the domain decoder and native XML projection consumer. The XML parser now retains raw `<data>` interiors from its source-position-aware validation pass, so entity references are filtered according to their native source spelling rather than their expanded DOM text. Raw XML source handling and existing Evidence/projection behavior remain unchanged. Follow the [contribution scope](https://github.com/morluto/rea/blob/main/CONTRIBUTING.md#contribution-scope). Unresolved scope, authority, side effects, or required verification block integration. Link the required maintainer scope decision for new providers or capabilities involving target execution, injection, mutation, or protection recovery; ordinary fixes within existing boundaries may state "not applicable". Draft PRs may leave the scope decision pending and the readiness and merge checklists unchecked. Maintainers can help resolve open questions. ## Contract and boundary impact - Semantic owner and earliest changed stage: Shared XML plist value decoding; `<data>` interpretation. - Contribution scope fit and linked maintainer decision: Existing runtime fix; maintainer scope decision not applicable. - CLI and MCP/tool-catalog contract: No contract or catalog changes. - Provider, bridge, target-format, or platform compatibility: Aligns XML plist data behavior with native CFPropertyList observations; no provider changes. - Evidence, artifact, provenance, or reconstruction contract: Existing raw source and projection/Evidence paths are preserved. - Target selection, authority, upstream behavior, and cleanup details (if applicable): Not applicable; no target execution or cleanup. - Generated metadata (`docs/public/product-catalog.json`), package, or installation impact (CI generates and validates ignored catalogs and `skills/`; edit authored instructions in `.agents/skills/reverse-engineer-anything/` and never commit build outputs): None. Expected effects (check known effects; use documentation-only on its own). Unchecked items do not establish absence; leave uncertainties visible. - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: Added shared decoder and native XML projection regressions for `AQID`, whitespace-separated ` A Q I D`, incomplete `AQI`, punctuation-containing `AQ!ID`, and entity reference `AQI&#33;D`. - Base reproduction or other evidence: The issue's native `plutil`/Python `plistlib` observations establish `AQID` and ` A Q I D` as `010203`, `AQI` as empty data, and `AQ!ID` as `010203`. The base decoder diverged for `AQI` and `AQ!ID`. - User-visible CLI/MCP output (if applicable): Existing projected data output remains the same shape, with corrected bytes for affected XML spellings. - Remaining proof gaps: Compiled boundary and real-provider workflows were not run. For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `npm run test:local -- src/domain/propertyListXml.test.ts src/native/parsers/plist.test.ts` — passed, 56 tests. - `npm run check:fast` — passed, typecheck and lint. - `npx oxfmt --check src/domain/propertyListXml.ts src/domain/propertyListXml.test.ts src/native/parsers/plist.test.ts` — passed. - `git diff --check` — passed. ## Compatibility, safety, and release - Breaking changes or migration steps: None; this corrects XML data bytes to match native behavior. - Real Hopper/Ghidra, browser, or OS coverage: Compiled boundary and real-provider workflows were not run. - Package or release metadata impact: None. - Security, privacy, process, or containment review: No target interaction, process execution, instrumentation, or sensitive-data handling was added. ## Author readiness Human owner: <!-- @GitHub-handle --> - [x] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [x] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [x] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [ ] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
bsakaguchi 2026-11-01 21:42:36 +00:00
Sign in to join this conversation.
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
morluto/rea#6726
No description provided.