Migrate to ATRAPS LLC: DFM recursion bound, copyright, trusted publishing - #2
Merged
Conversation
The form stream is untrusted input carved out of the analyzed binary, and neither the read_object/read_children cycle nor read_value's list arm bounded recursion — one nesting byte in the input bought one stack frame, so a crafted DFM could exhaust the stack and abort the process. Thread a depth counter through read_object, read_children, read_properties, and read_value, and bail out at MAX_DFM_DEPTH (64). Real Delphi forms nest a handful of levels, so the bound is far above anything legitimate while still cutting off unbounded descent. Rewiring every call site onto read_value_at left the old read_value wrapper with no callers, so drop it and move its doc comment onto the depth-carrying function.
`LayoutKind::NamedField { managed: _, .. }` binds a field the `..`
pattern already covers. Clippy did not flag this when CI last ran on
2026-07-07, but the workflow pins dtolnay/rust-toolchain@stable, so the
lint now fires on every build and fails the `-D warnings` gate.
No behaviour change — the arm matched the same values before.
Record ATRAPS LLC as copyright holder following the executed IP assignment. The Apache-2.0 appendix carried the correct year but named Johann Kempter personally. - LICENSE: appendix now reads "Copyright 2026 ATRAPS LLC" - NOTICE: added, per Apache-2.0 section 4(d) attribution channel - Cargo.toml: drop deprecated `authors`; point `repository` at the org - README: add a License section naming the holder; it previously had only a trailing one-line mention with no heading
Replace the long-lived CARGO_REGISTRY_TOKEN repo secret with a short-lived OIDC token minted per run by crates-io-auth-action and revoked when the job ends. Also gate the job on the release commit being contained in main: a release can be cut from any commit, including one that never landed on main, so the `release: published` trigger alone does not imply it.
`cargo update` within existing constraints. No direct dependency changed version — goblin, scroll, and tracing were already at their latest releases.
0.3.1 is already published and its metadata is immutable, so the corrected copyright holder, dropped `authors` field, and organisation repository URL only reach crates.io in a new version — as does the DFM recursion bound, which is the substantive change here.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Migration of this crate to ATRAPS LLC ownership, per TRANSFER.md. Two of these commits are real fixes, not hygiene.
fix: bound DFM nesting depth— was already in the working tree, unreleased. The form stream is untrusted input carved from the analyzed binary, and neither theread_object/read_childrencycle norread_value's list arm bounded recursion: one nesting byte bought one stack frame, so a crafted DFM could exhaust the stack and abort the process. Now capped atMAX_DFM_DEPTH(64).Rewiring the call sites onto
read_value_athad left the oldread_valuewrapper with no callers — dead code fails the-D warningsgate, so it is dropped and its doc comment moved onto the depth-carrying function.fix: drop redundant binding to satisfy current clippy—src/layout.rsbinds a field that..already covers. Clippy did not flag it when CI last ran (2026-07-07), but the workflow pins@stable, so the lint now fires and would fail this PR regardless of the migration. No behaviour change.chore: assign copyright—LICENSEappendix now readsCopyright 2026 ATRAPS LLC(year was already right, holder was personal).NOTICEadded;authorsdropped;repositoryrepointed at the org; README gains a proper License section, having previously had only a trailing one-line mention with no heading.ci:— trusted publishing replaces the stored token, and the job refuses to publish a release whose commit is not contained inmain.build:—cargo update; no direct dependency changed version.chore: release 0.3.2— 0.3.1 is published and immutable, so both fixes and the corrected metadata only reach crates.io in a new version.Verified locally: 114 tests pass, clippy clean, rustdoc clean under
-D warnings, fmt clean,cargo packageshipsLICENSEandNOTICE.Also deleted a stale local
masterbranch (0 unique commits, fully contained inmain).