mirror/rea
1
0
Fork 0
mirror of https://github.com/morluto/rea synced 2026-10-28 15:07:26 -04:00
Code Issues Packages Projects Releases Wiki Activity

fix(workers): reject malformed UTF-8 in JSON result files

Browse Source
This commit is contained in:
morluto
2026-10-27 00:28:31 +08:00
parent 1d32eb3aa4
commit c2b0c955cd
6 changed files with 283 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/javascript/analysis/JavaScriptAnalysisWorker.ts
+6 -4
View File
@@ -1,3 +1,4 @@
import { safeParseUtf8Json } from "../../domain/safeJson.js";
import { analysisSettingLimit } from "../../domain/analysisSettingDefinitions.js";
import { WorkerFrameSignal } from "../../process/WorkerFrameSignal.js";
import type {
@@ -719,17 +720,18 @@ export class JavaScriptAnalysisWorker {
remediationAction: JAVASCRIPT_PARENT_CHECKPOINT_HEAP_REMEDIATION,
},
);
const text = await readFile(path, "utf8");
const checkpoint = await readFile(path);
if (
expected !== undefined &&
createHash("sha256").update(text).digest("hex") !== expected.sha256
createHash("sha256").update(checkpoint).digest("hex") !== expected.sha256
)
throw new AnalysisOutputError(
OPERATION,
"JavaScript static checkpoint digest does not match",
);
const value: unknown = JSON.parse(text);
const facts = javaScriptWorkerStaticAnalysisSchema.parse(value);
const decoded = safeParseUtf8Json(checkpoint);
if (!decoded.ok) throw decoded.cause;
const facts = javaScriptWorkerStaticAnalysisSchema.parse(decoded.value);
const remaining = this.#remainingTotalResultBudget();
const retainedBytes = bytes * STATIC_CHECKPOINT_RETENTION_EXPANSION;
this.#parentCapacityExhausted = retainedBytes > remaining;