[PR #5779] [CLOSED] fix(apple): reject invalid binary date markers during keyed-archive decode (#5769) #7056

New issue

Closed

opened 2026-11-01 21:45:02 +00:00 by bsakaguchi · 0 comments

bsakaguchi commented

2026-11-01 21:45:02 +00:00

Owner

📋 Pull Request Information

Original PR: https://github.com/morluto/rea/pull/5779
Author: @Totopo27
Created: 10/21/2026
Status: ❌ Closed

Base: main ← Head: fix/5769-keyed-archive-invalid-date-marker

📝 Commits (1)

cb1a564 fix(apple): reject invalid binary date markers during keyed-archive decode (#5769)

📊 Changes

2 files changed (+42 additions, -0 deletions)

View changed files

📝 src/artifacts/apple/InterfaceBuilderDecodeBudget.ts (+18 -0)
📝 tests/boundary/filesystem/keyedArchiveScalarStructure.test.ts (+24 -0)

📄 Description

Summary

Fixes #5769.

inspect-keyed-archive accepted malformed binary property lists with invalid date markers such as 0x30 and projected them as valid observed dates (2001-01-01T00:00:00.100Z), because the pinned parser blindly read 8 bytes for any type-3 marker. Binary plist expansion preflight now validates scalar marker constraints (including that type 3 requires exact marker 0x33), rejecting malformed date objects with a typed format failure.

Problem and expected behavior

Apple's CoreFoundation binary property list specification dictates that date objects have type 0x3 with length 0x3 (marker byte 0x33), representing an 8-byte big-endian Float64. Other markers like 0x30 are invalid. macOS plutil -lint and Python plistlib reject 0x30, but REA accepted it and reported an observed date timestamp.

Expected behavior: reject malformed binary date markers with a typed format error while preserving valid archives.

Change and scope

In estimateBinaryPlistExpansion (src/artifacts/apple/InterfaceBuilderDecodeBudget.ts), added validation for binary plist scalar objects encountered during expansion:
- Type 0 (singletons): must be 0x00 (null), 0x08 (false), or 0x09 (true).
- Types 1 and 2 (int/real): length exponent must not exceed 4 (max 16-byte ints/reals) and payload must not be truncated.
- Type 3 (date): marker must be exactly 0x33 and payload must have 8 bytes within object table bounds.
Added test in tests/boundary/filesystem/keyedArchiveScalarStructure.test.ts ensuring 0x30 date markers throw and reject with a format error.

Ordinary bugfix within existing binary plist preflight boundaries; maintainer scope decision is not applicable.

Contract and boundary impact

Semantic owner and earliest changed stage: Binary plist expansion preflight / estimateBinaryPlistExpansion.
Contribution scope fit and linked maintainer decision: not applicable (bugfix).
CLI and MCP/tool-catalog contract: Unchanged schema. Malformed archives fail with typed format error.
Provider, bridge, target-format, or platform compatibility: Binary plists across all platforms.
Evidence, artifact, provenance, or reconstruction contract: Preserves evidence integrity by refusing malformed scalars instead of asserting invalid observed timestamps.
Target selection, authority, upstream behavior, and cleanup details: not applicable.
Generated metadata, package, or installation impact: None.

Expected effects:

Read existing files or captured data.
Launch or attach to a process.
Inject instrumentation or run scripts/code.
Change process memory, registers, files, or configuration.
Contact network services.
Recover protected code or work around protections.
Documentation or usability only; no target interaction.
Not sure yet; investigation or maintainer guidance needed.

Evidence and regression coverage

Tests added or updated: tests/boundary/filesystem/keyedArchiveScalarStructure.test.ts.
Base reproduction: Binary plist fixture with 0x33 replaced by 0x30.

User-visible CLI/MCP output:

{"error":"Analysis failed","code":"artifact_operation_failed","category":"execution_failure","message":"Artifact is invalid or has changed. Get a fresh copy and try again.","retryable":false,"remediation":{"action":"Artifact is invalid or has changed. Get a fresh copy and try again."},"details":{"operation":"inspect_keyed_archive","reason":"format","detail":"Cannot decode selected Foundation keyed archive: binary plist date object is invalid or truncated"}}

For evidence-bearing changes:

Observed, derived, and inferred claims remain distinguishable.
Artifact identity, source provenance, and failed attempts remain preserved.
Unsupported, incomplete, unavailable, or uncertain outcomes remain visible.

Validation performed

turbo run typecheck lint — passed clean.
npx vitest run tests/boundary/filesystem/keyedArchiveScalarStructure.test.ts — passed 6 tests.
Built CLI verification against valid and malformed archives.

Compatibility, safety, and release

Breaking changes or migration steps: None.
Real Hopper/Ghidra, browser, or OS coverage: Pure Node.js / binary parser, cross-platform.
Package or release metadata impact: None.
Security, privacy, process, or containment review: Refuses malformed input safely.

Author readiness

Human owner: @Totopo27

I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work.
I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps.
I declare this PR ready for initial maintainer review.

Before merge

This PR addresses a concrete problem or an agreed enhancement.
Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff.
The PR has one focused outcome and the title follows type(scope): outcome.
Related issue is linked, or the reason for not linking one is stated above.
Tests cover changed observable behavior and meaningful failure paths.
Owning docs, contracts, and generated metadata are updated where needed.
User-visible CLI/MCP changes include representative output.
I checked the final diff for secrets, unrelated cleanup, and unsupported claims.

_{🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.}

## 📋 Pull Request Information **Original PR:** https://github.com/morluto/rea/pull/5779 **Author:** [@Totopo27](https://github.com/Totopo27) **Created:** 10/21/2026 **Status:** ❌ Closed **Base:** `main` ← **Head:** `fix/5769-keyed-archive-invalid-date-marker` --- ### 📝 Commits (1) - [`cb1a564`](https://github.com/morluto/rea/commit/cb1a564eea09fd5a03c2e7c5b116ee42afbab459) fix(apple): reject invalid binary date markers during keyed-archive decode (#5769) ### 📊 Changes **2 files changed** (+42 additions, -0 deletions) <details> <summary>View changed files</summary> 📝 `src/artifacts/apple/InterfaceBuilderDecodeBudget.ts` (+18 -0) 📝 `tests/boundary/filesystem/keyedArchiveScalarStructure.test.ts` (+24 -0) </details> ### 📄 Description ## Summary Fixes #5769. `inspect-keyed-archive` accepted malformed binary property lists with invalid date markers such as `0x30` and projected them as valid observed dates (`2001-01-01T00:00:00.100Z`), because the pinned parser blindly read 8 bytes for any type-3 marker. Binary plist expansion preflight now validates scalar marker constraints (including that type 3 requires exact marker `0x33`), rejecting malformed date objects with a typed format failure. ## Problem and expected behavior Apple's CoreFoundation binary property list specification dictates that date objects have type `0x3` with length `0x3` (marker byte `0x33`), representing an 8-byte big-endian Float64. Other markers like `0x30` are invalid. macOS `plutil -lint` and Python `plistlib` reject `0x30`, but REA accepted it and reported an observed date timestamp. Expected behavior: reject malformed binary date markers with a typed format error while preserving valid archives. ## Change and scope - In `estimateBinaryPlistExpansion` (`src/artifacts/apple/InterfaceBuilderDecodeBudget.ts`), added validation for binary plist scalar objects encountered during expansion: - Type 0 (singletons): must be `0x00` (`null`), `0x08` (`false`), or `0x09` (`true`). - Types 1 and 2 (int/real): length exponent must not exceed 4 (max 16-byte ints/reals) and payload must not be truncated. - Type 3 (date): marker must be exactly `0x33` and payload must have 8 bytes within object table bounds. - Added test in `tests/boundary/filesystem/keyedArchiveScalarStructure.test.ts` ensuring `0x30` date markers throw and reject with a format error. Ordinary bugfix within existing binary plist preflight boundaries; maintainer scope decision is not applicable. ## Contract and boundary impact - Semantic owner and earliest changed stage: Binary plist expansion preflight / `estimateBinaryPlistExpansion`. - Contribution scope fit and linked maintainer decision: not applicable (bugfix). - CLI and MCP/tool-catalog contract: Unchanged schema. Malformed archives fail with typed `format` error. - Provider, bridge, target-format, or platform compatibility: Binary plists across all platforms. - Evidence, artifact, provenance, or reconstruction contract: Preserves evidence integrity by refusing malformed scalars instead of asserting invalid observed timestamps. - Target selection, authority, upstream behavior, and cleanup details: not applicable. - Generated metadata, package, or installation impact: None. Expected effects: - [x] Read existing files or captured data. - [ ] Launch or attach to a process. - [ ] Inject instrumentation or run scripts/code. - [ ] Change process memory, registers, files, or configuration. - [ ] Contact network services. - [ ] Recover protected code or work around protections. - [ ] Documentation or usability only; no target interaction. - [ ] Not sure yet; investigation or maintainer guidance needed. ## Evidence and regression coverage - Tests added or updated: `tests/boundary/filesystem/keyedArchiveScalarStructure.test.ts`. - Base reproduction: Binary plist fixture with `0x33` replaced by `0x30`. - User-visible CLI/MCP output: ```json {"error":"Analysis failed","code":"artifact_operation_failed","category":"execution_failure","message":"Artifact is invalid or has changed. Get a fresh copy and try again.","retryable":false,"remediation":{"action":"Artifact is invalid or has changed. Get a fresh copy and try again."},"details":{"operation":"inspect_keyed_archive","reason":"format","detail":"Cannot decode selected Foundation keyed archive: binary plist date object is invalid or truncated"}} ``` For evidence-bearing changes: - [x] Observed, derived, and inferred claims remain distinguishable. - [x] Artifact identity, source provenance, and failed attempts remain preserved. - [x] Unsupported, incomplete, unavailable, or uncertain outcomes remain visible. ## Validation performed - `turbo run typecheck lint` — passed clean. - `npx vitest run tests/boundary/filesystem/keyedArchiveScalarStructure.test.ts` — passed 6 tests. - Built CLI verification against valid and malformed archives. ## Compatibility, safety, and release - Breaking changes or migration steps: None. - Real Hopper/Ghidra, browser, or OS coverage: Pure Node.js / binary parser, cross-platform. - Package or release metadata impact: None. - Security, privacy, process, or containment review: Refuses malformed input safely. ## Author readiness Human owner: @Totopo27 - [ ] I reviewed the final diff and relevant existing code, understand the change and its edge cases, and take responsibility for the complete PR, including AI-assisted work. - [ ] I checked the evidence above, confirmed it supports the current change, and recorded meaningful validation gaps. - [ ] I declare this PR ready for initial maintainer review. ## Before merge - [x] This PR addresses a concrete problem or an agreed enhancement. - [x] Material scope and authority questions are resolved, and any required maintainer scope decision covers the final diff. - [x] The PR has one focused outcome and the title follows `type(scope): outcome`. - [x] Related issue is linked, or the reason for not linking one is stated above. - [x] Tests cover changed observable behavior and meaningful failure paths. - [x] Owning docs, contracts, and generated metadata are updated where needed. - [x] User-visible CLI/MCP changes include representative output. - [x] I checked the final diff for secrets, unrelated cleanup, and unsupported claims. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>

bsakaguchi

2026-11-01 21:45:02 +00:00