fix(init): bound associated domain reads

Author: seanperez29

packages/cli-core/src/commands/init/ios/associated-domain.test.ts

@@ -606,6 +606,38 @@ struct MyApp: App {
     expect(await treeDigest(linked)).toEqual(before);
   });
 
+  test("blocks an oversized entitlements file without changing it", async () => {
+    const root = await directFixture();
+    const path = join(root, "MyApp", "MyApp.entitlements");
+    const oversized = Buffer.alloc(1_000_001, 0x20);
+    await writeFile(path, oversized);
+
+    const plan = await planIOSAssociatedDomain(planOptions(root));
+    const result = await applyIOSAssociatedDomain(plan);
+
+    expect(plan.status).toBe("blocked");
+    expect(plan.blockers[0]?.code).toBe("unsupported-entitlements");
+    expect(result.status).toBe("blocked");
+    expect(await readFile(path)).toEqual(oversized);
+  });
+
+  test("returns stale without touching an entitlements file that grows beyond the limit", async () => {
+    const root = await directFixture();
+    const path = join(root, "MyApp", "MyApp.entitlements");
+    await removeAssociatedDomains(root);
+    const plan = await planIOSAssociatedDomain(planOptions(root));
+    const oversized = Buffer.alloc(1_000_001, 0x20);
+    await writeFile(path, oversized);
+
+    const prepared = await prepareIOSAssociatedDomainMutation(plan);
+    const result = await applyIOSAssociatedDomain(plan);
+
+    expect(plan.status).toBe("ready");
+    expect(prepared.status).toBe("stale");
+    expect(result.status).toBe("stale");
+    expect(await readFile(path)).toEqual(oversized);
+  });
+
   test("blocks an entity-encoded Associated Domains key without rewriting it", async () => {
     const root = await directFixture();
     const path = join(root, "MyApp", "MyApp.entitlements");

packages/cli-core/src/commands/init/ios/associated-domain.ts

@@ -2,6 +2,7 @@ import { lstat, readFile, realpath } from "node:fs/promises";
 import { dirname, resolve } from "node:path";
 import { parse as parsePbxProject } from "@bacons/xcode/json";
 import { decodePublishableKey } from "../../../lib/fapi.ts";
+import { readBoundedRegularFile } from "./bounded-file.ts";
 import { inspectTargetBuildConfigurations } from "./build-settings.ts";
 import {
   discoverLocalIOSProjects,
@@ -249,20 +250,46 @@ async function inspectEntitlementsFile(
     };
   }
 
-  try {
-    const info = await lstat(absolutePath);
-    if (!info.isFile() || info.isSymbolicLink() || info.size > MAX_ENTITLEMENTS_BYTES) {
-      return {
-        blocker: blocker(
-          "unsupported-entitlements",
-          `${relativeIOSPath(
-            root,
-            absolutePath,
-          )} must be a regular, non-symlink XML plist no larger than 1 MB.`,
-        ),
-      };
+  const file = await readBoundedRegularFile(absolutePath, MAX_ENTITLEMENTS_BYTES);
+  if (file.status === "not-regular" || file.status === "too-large") {
+    return {
+      blocker: blocker(
+        "unsupported-entitlements",
+        `${relativeIOSPath(
+          root,
+          absolutePath,
+        )} must be a regular, non-symlink XML plist no larger than 1 MB.`,
+      ),
+    };
+  }
+  if (file.status !== "ok") {
+    try {
+      const info = await lstat(absolutePath);
+      if (!info.isFile() || info.isSymbolicLink() || info.size > MAX_ENTITLEMENTS_BYTES) {
+        return {
+          blocker: blocker(
+            "unsupported-entitlements",
+            `${relativeIOSPath(
+              root,
+              absolutePath,
+            )} must be a regular, non-symlink XML plist no larger than 1 MB.`,
+          ),
+        };
+      }
+    } catch {
+      // Preserve the unreadable classification below when the current path
+      // cannot explain the bounded reader's failure.
     }
-    const bytes = new Uint8Array(await readFile(absolutePath));
+    return {
+      blocker: blocker(
+        "unreadable-entitlements",
+        `${relativeIOSPath(root, absolutePath)} could not be read as a UTF-8 XML plist dictionary.`,
+      ),
+    };
+  }
+
+  try {
+    const bytes = file.bytes;
     if (new TextDecoder().decode(bytes.slice(0, 8)).startsWith("bplist")) {
       return {
         blocker: blocker(
@@ -330,7 +357,7 @@ async function inspectEntitlementsFile(
         relativePath: relativeIOSPath(root, absolutePath),
         bytes,
         hash: hashIOSFileBytes(bytes),
-        mode: info.mode & 0o7777,
+        mode: file.mode,
         source,
         bom,
         domains,
@@ -866,17 +893,9 @@ export async function prepareIOSAssociatedDomainMutation(
       }
       continue;
     }
-    try {
-      if (!plannedFile.expectedHash) return { status: "blocked", plan };
-      const info = await lstat(absolutePath);
-      if (
-        !info.isFile() ||
-        info.isSymbolicLink() ||
-        hashIOSFileBytes(await readFile(absolutePath)) !== plannedFile.expectedHash
-      ) {
-        return { status: "stale", plan };
-      }
-    } catch {
+    if (!plannedFile.expectedHash) return { status: "blocked", plan };
+    const current = await readBoundedRegularFile(absolutePath, MAX_ENTITLEMENTS_BYTES);
+    if (current.status !== "ok" || hashIOSFileBytes(current.bytes) !== plannedFile.expectedHash) {
       return { status: "stale", plan };
     }
   }

packages/cli-core/src/commands/init/ios/bounded-file.ts

@@ -4,7 +4,7 @@ import { open } from "node:fs/promises";
 const READ_CHUNK_BYTES = 64 * 1024;
 
 export type BoundedRegularFileReadResult =
-  | { status: "ok"; bytes: Uint8Array }
+  | { status: "ok"; bytes: Uint8Array; mode: number }
   | { status: "missing" | "not-regular" | "too-large" | "unreadable" };
 
 function missingPath(error: unknown): boolean {
@@ -49,7 +49,11 @@ export async function readBoundedRegularFile(
       chunks.push(chunk.subarray(0, bytesRead));
     }
 
-    return { status: "ok", bytes: Buffer.concat(chunks, totalBytes) };
+    return {
+      status: "ok",
+      bytes: Buffer.concat(chunks, totalBytes),
+      mode: info.mode & 0o7777,
+    };
   } catch {
     return { status: "unreadable" };
   } finally {