M12-04J Status

status: done task: keep malicious ZIP/TAR fixtures in the long-term archive security regression updated: 2026-08-18 America/New_York enablingTask: false parityStateChange: false

Scope

Six deterministic binary fixtures cover ZIP path traversal, compression-ratio abuse, duplicate paths, TAR path traversal, symlink escape, and file/directory prefix conflict. The generator fixes container fields and timestamps; the checker regenerates every file in a temporary directory and requires byte-for-byte equality with the committed fixtures and catalog SHA-256 values.

The checker reads ZIP EOCD/central-directory and USTAR header metadata, verifies local-header bindings, TAR checksums, alignment, and end markers, then feeds the actual entry metadata into the M12-04D/G link and conflict gates. It never invokes tar, unzip, or an extraction API. All six fixtures fail closed with IO_ARCHIVE_UNSAFE and are included in the existing N-023 Chromium grep.

Evidence

node tools/web/check-malicious-archive-fixtures.mjs passed 6/6 with three ZIP and three TAR fixtures and extraction disabled.
WEB_TEST_PORT=5408 npm --prefix web run test:asset-library passed 2/2, including the persistent binary-fixture security test and the existing N-023 asset/IO gate.
Fixture byte lengths range from 115 to 3,072 bytes and every committed SHA-256 matches the generated catalog.

Artifact Hashes

parent manifest: 574afa68a787b9481d0e098d38b94cb810a9827fe185b0df796d62cc160ba7c5
generator: b372ea8cb2f97b035ffb2cc18666dae9167dcfb349131851ad9f1ff0fc40ba16
checker: edda2f420f26e55f9990d24b755bb9b4f732ec32c2e072210144b3d0b6634d9b
fixture manifest: a93834316f6a23b8a0e6c1f1f806ec584d6f03aa339c2680cae2ce8133a40e58
Chromium spec: f327500808dd67359a152ce28134b58d027aebd6758416b5535b659b9900bbfe
package commands: cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c
manifest: 989d417ab44e165849c7054f331f7038ec1d779349c39dd4f5b30050bbaecf56

Next Task

M12-05A: generate the glTF/GLB, OBJ, STL, PLY, USD, and Alembic format inventory from the pinned Blender 5.2 build/runtime.

Rollback

Remove the fixture generator/checker, six binary fixtures and catalog, Chromium spec, golden manifest, and this status entry. Restore M12-04I as the queue tail and move the machine queue back to M12-04J. No parity ledger rollback is required.

2.4 KiB Raw Blame History