Kaoru0822andClaude Opus 5.5 2bf812772d fix(apple): bound binary plist expansion before decoding keyed archives (#1515) ...

inspect_keyed_archive passed caller-selected binary plists straight to
plist.parseBinary, which recurses on every object reference and copies
shared containers. A 484-byte archive of forty nested [next, next] arrays
grew the process past 4 GB until it died with no result, which would also
end an MCP server. A 125-byte self-referencing array overflowed the stack
and was reported as an artifact too large to process.

The iterative reference walk that already guards decode_interface_builder
now runs first, with an 8x keyed-archive decode budget. Over-budget depth
or expansion is a limit; a reference cycle is a malformed archive. Its
"decoder" bounds admit the same layouts plist.parseBinary reads, so
accepted archives stay accepted. Interface Builder behavior is unchanged.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-10 01:44:46 -07:00

..

apple

fix(apple): bound binary plist expansion before decoding keyed archives (#1515)

2026-10-10 01:44:46 -07:00

extraction

refactor(artifacts): test inventory changes at materialization boundary

2026-10-10 02:49:46 +08:00

inventory

perf(artifacts)!: name each edge's child through its occurrence (#1493)

2026-10-10 00:58:05 -07:00

javascript

fix(artifacts): bind ASAR interpretation to owned snapshots

2026-10-10 06:20:28 +08:00

ArtifactHash.ts

refactor(artifacts): isolate JavaScript file acquisition (#916)

2026-10-07 17:57:33 +08:00

ArtifactPaths.test.ts

fix(artifacts): record each case collision once at its diverging segment (#1505)

2026-10-10 01:16:16 -07:00

ArtifactPaths.ts

fix(artifacts): record each case collision once at its diverging segment (#1505)

2026-10-10 01:16:16 -07:00

ArtifactProvider.ts

perf(artifacts): stop repeating every artifact path as Evidence locations (#1492)

2026-10-10 00:47:51 -07:00

ArtifactProviderMetadata.ts

refactor(providers): use canonical artifact and managed identities

2026-10-10 00:49:14 +08:00

ArtifactReader.ts

fix(providers): preserve observations and primary cleanup failures

2026-10-09 21:01:52 +08:00

AsarArtifactReader.ts

fix(artifacts): bind ASAR interpretation to owned snapshots

2026-10-10 06:20:28 +08:00

AsarEntryStream.ts

perf(artifacts): stream ASAR members without full buffering (#962)

2026-10-07 23:57:05 +08:00

DirectoryArtifactReader.ts

refactor: use canonical implementations and types directly

2026-10-09 23:35:19 +08:00

MachOSliceArtifactReader.test.ts

refactor!: enforce canonical evidence and provider boundaries

2026-10-09 20:18:52 +08:00

MachOSliceArtifactReader.ts

refactor!: enforce canonical evidence and provider boundaries

2026-10-09 20:18:52 +08:00

NativeDmgArtifactReader.ts

fix(artifacts): retain DMG ownership through uncertain attachment

2026-10-10 00:35:17 +08:00

NativeDmgOwnership.ts

fix(artifacts): retain DMG ownership through uncertain attachment

2026-10-10 00:35:17 +08:00

readStableArtifact.test.ts

feat(browser): inspect historical web network captures (#992)

2026-10-08 07:53:41 +08:00

readStableArtifact.ts

feat(browser): inspect historical web network captures (#992)

2026-10-08 07:53:41 +08:00

SafeOutputTree.ts

fix(artifacts): keep case-distinct archive names in inventory (#1480)

2026-10-10 15:21:16 +08:00

StreamBytes.ts

Add evidence-backed investigation workflows

2026-07-12 21:12:18 +00:00

ZipArtifactReader.ts

fix(android): validate engine archive prerequisites (#1145)

2026-10-09 09:15:33 +08:00