50 lines
2.4 KiB
Markdown
50 lines
2.4 KiB
Markdown
# M12-04J Status
|
|
|
|
status: done
|
|
task: keep malicious ZIP/TAR fixtures in the long-term archive security regression
|
|
updated: 2026-08-18 America/New_York
|
|
enablingTask: false
|
|
parityStateChange: false
|
|
|
|
## Scope
|
|
|
|
Six deterministic binary fixtures cover ZIP path traversal, compression-ratio abuse, duplicate
|
|
paths, TAR path traversal, symlink escape, and file/directory prefix conflict. The generator fixes
|
|
container fields and timestamps; the checker regenerates every file in a temporary directory and
|
|
requires byte-for-byte equality with the committed fixtures and catalog SHA-256 values.
|
|
|
|
The checker reads ZIP EOCD/central-directory and USTAR header metadata, verifies local-header
|
|
bindings, TAR checksums, alignment, and end markers, then feeds the actual entry metadata into the
|
|
M12-04D/G link and conflict gates. It never invokes `tar`, `unzip`, or an extraction API. All six
|
|
fixtures fail closed with `IO_ARCHIVE_UNSAFE` and are included in the existing N-023 Chromium grep.
|
|
|
|
## Evidence
|
|
|
|
- `node tools/web/check-malicious-archive-fixtures.mjs` passed 6/6 with three ZIP and three TAR
|
|
fixtures and extraction disabled.
|
|
- `WEB_TEST_PORT=5408 npm --prefix web run test:asset-library` passed 2/2, including the persistent
|
|
binary-fixture security test and the existing N-023 asset/IO gate.
|
|
- Fixture byte lengths range from 115 to 3,072 bytes and every committed SHA-256 matches the
|
|
generated catalog.
|
|
|
|
## Artifact Hashes
|
|
|
|
- parent manifest: `574afa68a787b9481d0e098d38b94cb810a9827fe185b0df796d62cc160ba7c5`
|
|
- generator: `b372ea8cb2f97b035ffb2cc18666dae9167dcfb349131851ad9f1ff0fc40ba16`
|
|
- checker: `edda2f420f26e55f9990d24b755bb9b4f732ec32c2e072210144b3d0b6634d9b`
|
|
- fixture manifest: `a93834316f6a23b8a0e6c1f1f806ec584d6f03aa339c2680cae2ce8133a40e58`
|
|
- Chromium spec: `f327500808dd67359a152ce28134b58d027aebd6758416b5535b659b9900bbfe`
|
|
- package commands: `cfb232baa494ff59f6c8d65514a08c86332ee9354350b2a0392b6f932a7ee42c`
|
|
- manifest: `989d417ab44e165849c7054f331f7038ec1d779349c39dd4f5b30050bbaecf56`
|
|
|
|
## Next Task
|
|
|
|
`M12-05A`: generate the glTF/GLB, OBJ, STL, PLY, USD, and Alembic format inventory from the pinned
|
|
Blender 5.2 build/runtime.
|
|
|
|
## Rollback
|
|
|
|
Remove the fixture generator/checker, six binary fixtures and catalog, Chromium spec, golden
|
|
manifest, and this status entry. Restore M12-04I as the queue tail and move the machine queue back to
|
|
`M12-04J`. No parity ledger rollback is required.
|