7711b00005
* fix(apple): preflight XML plist nesting before keyed archive decoding inspect_keyed_archive documented a 128-level nesting limit, but the XML plist path reached recursive decoding before any depth check: plist and the prototype-key traversal in parseXmlPropertyList recurse once per nesting level, so a ~75 KiB, 3000-level XML plist exhausted the call stack and reported Maximum call stack size exceeded instead of the bounded-resource limit that shallower over-limit documents (129, 200) already produced. The CLI classified both as truncated, so no crash or classification bypass was involved; the diagnostic was the defect. Reject excessive nesting in parseXmlPropertyList before any recursive pass, using the projection's own limit (MAX_PLIST_DEPTH) so the error is identical to the one projectPlistValue raises: callers keep the limit/truncated classification with no error-handler translation. Depth counts values the way the projection does - container members nest one level deeper, dictionary keys name members rather than nesting, and a self-closing element is the value at its own level - so the guard rejects exactly the documents the projection rejected, at the same boundary, and every in-limit document decodes unchanged. The guard sits at the shared decoder boundary, so Interface Builder, app Info.plist resolution and native inspect_plist gain the same deterministic limit; the binary plist path keeps its existing expansion preflight. Binary plist behavior, ordinary XML decode, __proto__ omission counting, and archive digest/Evidence provenance are unchanged. OpenStep autodetection is untouched by this guard, as the existing Interface Builder preflight also scopes its depth check to XML. Regression coverage: decoder unit tests at and just past the limit for dictionary and array nesting with self-closing and opaque markup, module tests through decodeKeyedArchiveBytes including a valid NSKeyedArchiver XML envelope at the limit, a production-boundary test through inspectBundleKeyedArchive, and the compiled public CLI reporting code truncated / reason limit for a 3000-level plist. * fix(apple): check XML nesting against parsed element structure Reuse the iterative XML decoder document for depth preflight and prototype-key lookup. Bound recursive plist wrappers alongside dictionaries and arrays without interpreting markup inside attributes or DOCTYPE declarations as values. Validated with 104 focused tests including compiled CLI, MCP prototype-key, and Interface Builder coverage; npm run check and verify:test-discovery passed. No real-provider verification was run. --------- Co-authored-by: Zburgers <Zburgers@users.noreply.github.com> Co-authored-by: morluto <76467478+morluto@users.noreply.github.com>
79 lines
2.6 KiB
TypeScript
79 lines
2.6 KiB
TypeScript
import { writeFile } from "node:fs/promises";
|
|
import { join } from "node:path";
|
|
|
|
import { expect } from "vitest";
|
|
import { build } from "plist";
|
|
|
|
import { parseEvidence } from "../../../src/domain/evidence.js";
|
|
import { createTestTempDirectory } from "../../fixtures/temporaryDirectory.js";
|
|
import { deeplyNestedXmlPlist } from "../../fixtures/keyedArchiveXmlNesting.js";
|
|
import { cliTest } from "../../support/cli/cliFixture.js";
|
|
|
|
for (const [name, xml] of [
|
|
["dictionaries", deeplyNestedXmlPlist(3000)],
|
|
[
|
|
"quoted attributes",
|
|
deeplyNestedXmlPlist(3000).replaceAll("<dict>", '<dict note="/>">'),
|
|
],
|
|
[
|
|
"plist wrappers",
|
|
"<plist>".repeat(3000) + "<string>x</string>" + "</plist>".repeat(3000),
|
|
],
|
|
] as const) {
|
|
cliTest(
|
|
`compiled CLI reports deeply nested XML ${name} as the decode limit`,
|
|
async ({ cli }) => {
|
|
const root = await createTestTempDirectory("rea-keyed-cli-depth-");
|
|
const path = join(root, "Deep.plist");
|
|
await writeFile(path, xml);
|
|
const output = await cli.run({
|
|
arguments: ["inspect-keyed-archive", path, "--json"],
|
|
environment: { REA_LOG_LEVEL: "silent", REA_ANALYSIS_PROVIDER: "auto" },
|
|
});
|
|
expect(output.exitCode, output.stderr).toBe(1);
|
|
expect(output.json).toMatchObject({
|
|
code: "truncated",
|
|
category: "truncated",
|
|
details: {
|
|
reason: "limit",
|
|
truncated: true,
|
|
detail:
|
|
"Cannot decode selected Foundation keyed archive: Plist exceeds 128 nesting levels",
|
|
},
|
|
});
|
|
},
|
|
);
|
|
}
|
|
|
|
cliTest(
|
|
"compiled CLI decodes a shallow archive with opaque DOCTYPE markup",
|
|
async ({ cli }) => {
|
|
const root = await createTestTempDirectory("rea-keyed-cli-doctype-");
|
|
const path = join(root, "Shallow.plist");
|
|
const archive = build({
|
|
$archiver: "NSKeyedArchiver",
|
|
$version: 100000,
|
|
$objects: ["$null", "leaf"],
|
|
$top: { root: { UID: 1 } },
|
|
});
|
|
await writeFile(
|
|
path,
|
|
archive.replace(
|
|
/<!DOCTYPE[^>]*>/u,
|
|
`<!DOCTYPE plist [<!ENTITY first "unused"><!ENTITY second "${"<dict>".repeat(130)}">]>`,
|
|
),
|
|
);
|
|
const output = await cli.run({
|
|
arguments: ["inspect-keyed-archive", path, "--json"],
|
|
environment: { REA_LOG_LEVEL: "silent", REA_ANALYSIS_PROVIDER: "auto" },
|
|
});
|
|
expect(output.exitCode, output.stderr).toBe(0);
|
|
expect(parseEvidence(output.json).normalized_result).toMatchObject({
|
|
archive_format: "xml-plist",
|
|
objects: expect.arrayContaining([
|
|
expect.objectContaining({ value: "leaf" }),
|
|
]),
|
|
});
|
|
},
|
|
);
|