{"record":{"id":"17fb2a74c19b1483","repo":"affaan-m/ECC","slug":"unsafe-nasiko-archive-expected-exactly-one-bounde","errorCode":null,"errorMessage":"Unsafe Nasiko archive: expected exactly one bounded regular binary file.","messagePattern":"Unsafe Nasiko archive: expected exactly one bounded regular binary file\\.","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"error","filePath":"scripts/lib/nasiko-release.js","lineNumber":130,"sourceCode":"    }\n    const name = readTarString(header, 0, 100);\n    const prefix = readTarString(header, 345, 155);\n    const type = String.fromCharCode(header[156] || 48);\n    const size = readTarOctal(header, 124, 12);\n    const start = offset + 512;\n    const end = start + size;\n    const paddedEnd = start + Math.ceil(size / 512) * 512;\n    if (!Number.isSafeInteger(end) || paddedEnd > tar.length) throw new Error('Nasiko archive is truncated.');\n    const payload = tar.subarray(start, end);\n    if (!tar.subarray(end, paddedEnd).every(byte => byte === 0)) {\n      throw new Error('Unsafe Nasiko archive: nonzero tar padding.');\n    }\n    const isBinary = !prefix && name === expectedName && (type === '0' || type === '\\0');\n    const isAppleDouble = !prefix && name === `._${expectedName}` && type === '0' && size <= 1024 * 1024;\n    const isPaxMetadata = !prefix && name === `PaxHeader/${expectedName}` && type === 'x' && size <= 64 * 1024\n      && !/(?:^|\\n)(?:path|linkpath)=/i.test(payload.toString('utf8'));\n    if (isBinary && !binary && size > 0 && size <= MAX_BINARY_BYTES) binary = Buffer.from(payload);\n    else if (!isAppleDouble && !isPaxMetadata) throw new Error('Unsafe Nasiko archive: expected exactly one bounded regular binary file.');\n    offset = paddedEnd;\n  }\n  if (!terminated) throw new Error('Unsafe Nasiko archive: missing complete tar terminator.');\n  if (!binary) throw new Error('Unsafe Nasiko archive: expected exactly one bounded regular binary file.');\n  return binary;\n}\n\nfunction fetchBytes(url, options = {}) {\n  const parsed = new URL(url);\n  if (parsed.origin !== REGISTRY_ORIGIN || parsed.protocol !== 'https:') return Promise.reject(new Error('Nasiko download origin is not allowed.'));\n  const maxBytes = options.maxBytes || MAX_ARCHIVE_BYTES;\n  return new Promise((resolve, reject) => {\n    const request = https.get(parsed, { headers: options.accept ? { Accept: options.accept } : {} }, response => {\n      if (response.statusCode >= 300 && response.statusCode < 400) { response.resume(); reject(new Error('Nasiko registry redirects are not allowed.')); return; }\n      if (response.statusCode !== 200) { response.resume(); reject(new Error(`Nasiko registry returned HTTP ${response.statusCode}.`)); return; }\n      const chunks = [];\n      let total = 0;\n      response.on('data', chunk => {","sourceCodeStart":112,"sourceCodeEnd":148,"githubUrl":"https://github.com/affaan-m/ECC/blob/8321021c54d670126ce3b2969d5deb880b4b0c2a/scripts/lib/nasiko-release.js#L112-L148","documentation":"The extractor is a strict allowlist parser: it accepts exactly one bounded regular binary matching the expected name (plus optional AppleDouble and PaxHeader metadata entries). Any other entry — or a second copy of the binary — causes this error. The final post-loop check also throws it when the loop ended without ever capturing a binary payload (e.g., zero-size binary or no matching entry).","triggerScenarios":"Calling extractQualifiedTarGzip with an archive containing: (a) an unexpected extra file entry, (b) a binary entry larger than MAX_BINARY_BYTES or with size 0, (c) a duplicate expected-name entry, or (d) no entry matching expectedName at all.","commonSituations":"Registry publishes a repackaged tarball with extra files (LICENSE, README) inside; the release pipeline changed the inner filename; a supply-chain tampering attempt embedding extra payloads; version mismatch between expected name and actual artifact.","solutions":["Verify the downloaded version matches the version whose inner filename you expect; re-fetch the matching release.","Re-download from the official registry — a modified archive likely contains added entries.","Check MAX_BINARY_BYTES versus the actual binary size; if the artifact legitimately grew, update the bound in the code/config.","Inspect the archive listing (tar -tvf) to see which entry violates the allowlist."],"exampleFix":"// before\nconst binary = extractQualifiedTarGzip(tar); // archive contains README.md too\n// after\nconst entries = listTarEntries(tar);\nif (entries.some(e => !ALLOWED_NAMES.has(e.name))) throw new Error('Archive has unexpected entries: ' + entries.map(e => e.name));\nconst binary = extractQualifiedTarGzip(tar);","handlingStrategy":"validation","validationCode":"const names = listTarEntries(tar).map(e => e.name); if (names.filter(n => n === expectedName).length !== 1) throw new Error('Archive must contain exactly one entry named ' + expectedName);","typeGuard":null,"tryCatchPattern":"try { return extractQualifiedTarGzip(tar, expectedName); } catch (err) { if (err.message.includes('expected exactly one bounded regular binary')) logAndFailWithListing(tar); throw err; }","preventionTips":["Pin the exact version and platform so expectedName matches the artifact","List archive contents before extraction and compare against an allowlist","Raise MAX_BINARY_BYTES deliberately when a release legitimately grows","Alert on any tarball containing entries beyond binary + AppleDouble + PaxHeader"],"tags":["archive","tar","validation","security"],"backgroundTag":"unexpected-response-shape","analyzedSha":"8321021c54d670126ce3b2969d5deb880b4b0c2a","analyzedAt":"2026-09-16T10:08:13.343Z","contentChangedAt":"2026-09-16T10:08:13.343Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}