Documentation
¶
Overview ¶
Package infoplist holds the shared ceiling the CLI applies when it expands an app bundle's Info.plist out of an IPA archive.
An IPA is an untrusted ZIP archive: the CLI may be handed one by a CI job, a release pipeline, or a contributor. A ZIP member advertises its uncompressed size in metadata that the archive itself controls, and a highly compressible member expands to far more than it costs to store. Reading the selected Info.plist with an unbounded io.ReadAll therefore lets a small artifact drive an arbitrarily large allocation. Every IPA metadata reader shares the policy below so both the advertised size and the bytes actually streamed are rejected once they pass the limit.
Index ¶
Constants ¶
const MaxBytes = 4 << 20
MaxBytes is the largest uncompressed size accepted for the top-level Payload/*.app/Info.plist member of an IPA.
A real top-level app Info.plist is a few kilobytes: a handful of bundle identifiers, version strings, supported platforms, icon names, and URL schemes. Even the unusually large ones — long ATS exception lists, wide device-capability matrices, or heavily localized declarations — stay in the low hundreds of kilobytes. 4 MiB leaves more than an order of magnitude of headroom above any plist Xcode plausibly emits while capping how much a crafted archive can force the CLI to allocate. There is deliberately no flag or environment override: raising the ceiling is the same as removing it.
const MaxDepth = 128
MaxDepth is the deepest container chain accepted in an app Info.plist. Xcode-generated metadata is normally fewer than ten levels deep. A limit of 128 keeps ample room for hand-authored URL schemes, scene manifests, and extension dictionaries while preventing recursive plist decoders from being driven into pathological stack growth.
const MaxObjects = 65_536
MaxObjects bounds the number of scalar and container values a plist decoder may materialize. Sixty-five thousand values are already far beyond a real app manifest, but keep the 4 MiB byte allowance useful for legitimately wide arrays and dictionaries.
Variables ¶
This section is empty.
Functions ¶
func CheckDeclaredSize ¶
CheckDeclaredSize rejects an Info.plist whose ZIP metadata already advertises more than MaxBytes, so an oversized member is refused before it is opened or decompressed.
func ReadBounded ¶
ReadBounded expands at most MaxBytes from reader and fails if more bytes are available, so forged or absent ZIP size metadata cannot bypass CheckDeclaredSize.
func ValidateStructure ¶
ValidateStructure applies format-aware depth and object-count limits before the third-party plist decoder materializes the document.
Types ¶
This section is empty.
Source Files
Directories
¶
| Path | Synopsis |
|---|---|
|
Package infoplisttest provides helpers for tests that exercise the Info.plist expansion limits against hand-forged ZIP metadata.
|
Package infoplisttest provides helpers for tests that exercise the Info.plist expansion limits against hand-forged ZIP metadata. |