From efbc486b9bf8ab46da16fdd6ed88128849e30e81 Mon Sep 17 00:00:00 2001 From: qorvr Date: Thu, 15 Oct 2026 00:44:31 +0530 Subject: [PATCH] fix(contracts): reject NUL bytes in keyed archive and extraction paths (#3606) Co-authored-by: qorvr <330186599+qorvr@users.noreply.github.com> --- src/contracts/artifactToolContracts.ts | 3 ++- src/domain/apple/keyedArchive.ts | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/src/contracts/artifactToolContracts.ts b/src/contracts/artifactToolContracts.ts index 3d63488a4c..37502b8184 100644 --- a/src/contracts/artifactToolContracts.ts +++ b/src/contracts/artifactToolContracts.ts @@ -9,6 +9,7 @@ import { requireOutputSchema } from "./toolOutputSchemaPrimitives.js"; import { appleAssetCatalogInputSchema } from "../domain/apple/appleAssetCatalog.js"; import { dylibResolutionInputSchema } from "../domain/apple/dylibResolution.js"; import { keyedArchiveInputSchema } from "../domain/apple/keyedArchive.js"; +import { localPathStringSchema } from "../domain/localPath.js"; import { analysisDetailSchema } from "./analysisDetail.js"; /** Exact caller boundary for deterministic artifact inventory. */ export const artifactInventoryInputSchema = z.strictObject({ @@ -34,7 +35,7 @@ export const artifactExtractionInputSchema = z.strictObject({ /** Provider input containing the destination chosen by the local adapter. */ export const artifactExtractionExecutionSchema = artifactExtractionInputSchema.extend({ - output_root: z.string().min(1), + output_root: localPathStringSchema, }); const exampleInputSchema = z.record(z.string(), jsonValueSchema); diff --git a/src/domain/apple/keyedArchive.ts b/src/domain/apple/keyedArchive.ts index 52a52a1073..d2d40951ac 100644 --- a/src/domain/apple/keyedArchive.ts +++ b/src/domain/apple/keyedArchive.ts @@ -1,6 +1,7 @@ import { z } from "zod"; import { AnalysisInputError } from "../analysisErrorCore.js"; import { jsonValueSchema, type JsonValue } from "../jsonValue.js"; +import { localPathStringSchema } from "../localPath.js"; /** * The selected file is intact but is another kind of file, so another tool @@ -20,7 +21,7 @@ export class KeyedArchiveKindError extends TypeError { /** Select one archive within the active bundle and optionally one named root. */ export const keyedArchiveInputSchema = z.strictObject({ - path: z.string().min(1).default("."), + path: localPathStringSchema.default("."), root: z.string().optional(), offset: z.number().int().min(0).default(0), limit: z.number().int().min(1).max(20_000).default(20_000),