rea/docs
Dery Ferdika bfbfc7330a
fix(domain): reject excessive JSON depth with actionable diagnostics (#1029)
* fix(domain): bound JSON depth and oversized payloads at parsing boundaries

jsonValueSchema re-walked hostile input through z.json()'s recursive core, so a deeply nested payload from an MCP tool argument, inline evidence, provider result, or keyed archive threw RangeError: Maximum call stack size exceeded instead of a validation issue. The schema now runs an iterative depth guard first and keeps z.json() for full JSON semantics behind it, which also turns cyclic values into validation errors. The 1000-edge limit stays far below the range where the recursive core overflows its stack (measured between 2000 and 3000 on Node 24) while leaving room for legitimately deep target-derived trees such as compiled NIB view hierarchies, and the guard narrows with a typed record check instead of any or unchecked casts. The non-recursive JSON Schema advertisement stays intact on both the public and standard projection paths. Two payload sizes get explicit budgets tied to their producer constraints: web text artifacts reject beyond the 16 MiB source budget the web tooling already advertises, and native UI screenshot base64 beyond the 64 MiB helper output budget. Regenerated product catalog, skill catalog digest, and completion-ledger manifest follow the schema-boundary change.

* fix(validation): preserve depth diagnostics across process inputs

---------

Co-authored-by: N0zoM1z0 <1705004398@qq.com>
2026-10-08 21:12:10 +08:00
..
.vitepress docs: simplify the English README and organize guides (#1043) 2026-10-08 11:44:00 +08:00
adr refactor(binary): move production composition outside application workflows (#965) 2026-10-07 21:56:58 +08:00
assets docs: add Discord community links to README 2026-10-05 17:36:29 +08:00
verification fix(domain): reject excessive JSON depth with actionable diagnostics (#1029) 2026-10-08 21:12:10 +08:00
android-analysis.md docs: publish VitePress documentation on GitHub Pages 2026-10-07 16:58:04 +08:00
apple-application-analysis.md fix(artifacts): propagate conditional loads and bind digests to parsed images 2026-10-07 12:58:20 +00:00
architecture.mermaid feat(native): inspect recorded crashes through pwntools and pwndbg (#1054) 2026-10-08 16:50:31 +08:00
binary-diagnostics.md feat(native): inspect offline ELF layout through pwntools (#1037) 2026-10-08 14:22:08 +08:00
browser-observation.md fix(browser): preserve authorized redirect hops (#986) 2026-10-08 01:08:31 +08:00
browser-scenario-contract.md feat(browser): capture correlated network content and lifecycle evidence (#797) 2026-10-07 04:35:49 +08:00
capability-migration.md refactor(artifacts): move inventory and extraction into provider owners (#1032) 2026-10-08 05:51:14 +08:00
cli.md docs: simplify the English README and organize guides (#1043) 2026-10-08 11:44:00 +08:00
electron-observation.md fix(tools)!: simplify direct invocation and harden boundary contracts (#555) 2026-10-05 20:16:44 +08:00
error-contract.schema.json feat(evm): inspect offline bytecode interfaces through EVMole (#1051) 2026-10-08 15:32:05 +08:00
evm-bytecode.md feat(evm): inspect offline bytecode interfaces through EVMole (#1051) 2026-10-08 15:32:05 +08:00
firmware-analysis.md docs: publish VitePress documentation on GitHub Pages 2026-10-07 16:58:04 +08:00
ghidra-dos.md fix(ghidra): admit the 12.1 line and the install's JDK range (#840) 2026-10-07 12:24:36 +08:00
ghidra-nativeaot.md fix(ghidra): admit the 12.1 line and the install's JDK range (#840) 2026-10-07 12:24:36 +08:00
ida-provider.md feat(ida): add read-only GUI and headless MCP providers (#754) 2026-10-07 01:47:05 +08:00
index.md docs: publish VitePress documentation on GitHub Pages 2026-10-07 16:58:04 +08:00
installation.md chore(release/6.0.0): release rea-agents 6.0.0 (#1058) 2026-10-08 17:40:01 +08:00
javascript-application-graph.md refactor!: simplify runtime tools and remove replay engines (#572) 2026-10-05 21:15:04 +08:00
javascript-application-workflows.md fix(javascript): keep mutated object initializer values unknown (#752) 2026-10-07 10:51:44 +08:00
javascript-artifact-reconstruction.md fix(javascript): complete large-ASAR analysis with file-local projection (#1055) 2026-10-08 16:15:35 +08:00
javascript-recovery.md feat(javascript): recover readable modules with Wakaru (#848) 2026-10-07 12:46:13 +08:00
javascript-runtime-observation.md docs: clarify onboarding and align provider guidance (#745) 2026-10-06 22:57:36 +08:00
javascript-runtime-reconciliation.md fix(tools)!: simplify direct invocation and harden boundary contracts (#555) 2026-10-05 20:16:44 +08:00
managed-code-analysis.md feat(ghidra): support native x86 PE applications on Windows (#1030) 2026-10-08 05:11:47 +08:00
mcp-contracts.md fix(mcp): bound capture comparison input schema depth (#1005) 2026-10-08 12:26:00 +08:00
mcp-prompts.md fix(target): explain the JavaScript directory analysis route (#733) 2026-10-06 19:53:08 +08:00
native-investigation.md chore: merge main into feat/dylib-resolution 2026-10-08 06:23:44 +00:00
process-capture.md fix(process): preserve partial evidence and verify detached cleanup (#1011) 2026-10-08 04:46:46 +08:00
product-catalog.json fix(domain): reject excessive JSON depth with actionable diagnostics (#1029) 2026-10-08 21:12:10 +08:00
provider-evaluation.md feat(ghidra): support native x86 PE applications on Windows (#1030) 2026-10-08 05:11:47 +08:00
reconstruction-obligation-ledgers.md refactor: return complete analysis results inline 2026-09-29 08:07:24 +08:00
reconstruction-readiness.md fix(tools)!: simplify direct invocation and harden boundary contracts (#555) 2026-10-05 20:16:44 +08:00
recorded-crashes.md feat(native): inspect recorded crashes through pwntools and pwndbg (#1054) 2026-10-08 16:50:31 +08:00
releasing.md fix(release): recognize conventional titles in GitHub merge commits 2026-10-08 10:21:02 +00:00
roadmap.md docs: simplify the English README and organize guides (#1043) 2026-10-08 11:44:00 +08:00
testing.md feat(native): inspect recorded crashes through pwntools and pwndbg (#1054) 2026-10-08 16:50:31 +08:00
tool-design.md refactor!: simplify runtime tools and remove replay engines (#572) 2026-10-05 21:15:04 +08:00
user-visible-errors.csv refactor(process): separate capture implementation from analyst workflows (#988) 2026-10-08 00:46:21 +08:00
web-network-captures.md feat(browser): inspect historical web network captures (#992) 2026-10-08 07:53:41 +08:00
web-runtime.md feat(browser): attribute native execution and listener sources (#917) 2026-10-07 21:45:07 +08:00
web-source-location.md feat(browser): trace captured website source-map locations (#897) 2026-10-07 16:21:18 +08:00
website-module-trace.md feat(browser): trace captured website module imports (#879) 2026-10-07 14:59:52 +08:00
website-script-export.md feat(web): export captured scripts for JavaScript application analysis (#801) 2026-10-07 05:24:32 +08:00
windows-ghidra-p0.md feat(ghidra): support native x86 PE applications on Windows (#1030) 2026-10-08 05:11:47 +08:00