#!/usr/bin/env python3 # /// script # requires-python = ">=3.12,<3.16" # dependencies = [] # [tool.ty.environment] # extra-paths = ["."] # /// """Offline, non-executing evidence collection for CVE-2026-111497.""" from __future__ import annotations import argparse import bz2 import gzip import io import json import lzma import os import re import stat import sys import tarfile import tomllib import zipfile import zlib from contextlib import contextmanager from itertools import islice from pathlib import Path from typing import TYPE_CHECKING, BinaryIO, cast from brotli_binary_data import ( Buffer, DataChangedError, DataLimitError, file_data, read_data, sha256_data, ) from brotli_binary_match import ( REFERENCES, CodeAssessment, CodeReference, file_backed_ranges, load_references, match_code, ) from brotli_binary_metadata import decoder_metadata if TYPE_CHECKING: from collections.abc import Generator REGISTRY = Path(__file__).resolve().parent.parent / "references" / "fingerprints.json" SOURCE_SUFFIXES = {"", ".c", ".cc", ".cpp", ".cxx", ".h", ".inc", ".inl", ".unbr"} JS_SUFFIXES = {".js", ".mjs", ".cjs", ".jsx", ".ts", ".mts", ".cts", ".tsx"} NATIVE_SUFFIXES = {".so", ".dylib", ".dll", ".node", ".a", ".lib", ".wasm", ".exe"} ZIP_SUFFIXES = {".zip", ".jar", ".war", ".ear", ".whl", ".nupkg", ".apk"} BINARY_SYMBOLS = ( b"BrotliDecoderDecompress", b"BrotliDecoderCreateInstance", b"BrotliDecoderVersion", b"BrotliDecoderDestroyInstance", b"BrotliEncoderCompress", b"BrotliEncoderVersion", b"libbrotlidec", b"libbrotlicommon", b"libbrotlienc", b"org/brotli/dec/", b"com/aayushatharva/brotli4j/", b"DecoderJNI", ) BINARY_INDICATOR_PATTERN = re.compile( b"|".join(re.escape(symbol) for symbol in sorted(BINARY_SYMBOLS, key=len, reverse=True)) ) INDICATOR_CHUNK_BYTES = 4 * 1024 * 1024 TEXT_PROBE_BYTES = 4096 COMPRESSED_SUFFIXES = {".gz": "gzip", ".bz2": "bzip2", ".xz": "xz"} TAR_SUFFIXES = (".tar", ".tgz", ".txz", ".tbz", ".tbz2") UNSUPPORTED_SUFFIXES = { ".deb", ".rpm", ".zst", ".zstd", ".tzst", ".7z", ".rar", ".br", ".lz", ".lz4", ".lzma", ".z", ".cab", ".iso", ".dmg", ".cpio", ".ar", } ARCHIVE_SIGNATURES = ( (b"PK\x03\x04", "zip"), (b"PK\x05\x06", "zip"), (b"PK\x07\x08", "zip"), (b"\x1f\x8b", "gzip"), (b"BZh", "bzip2"), (b"\xfd7zXZ\0", "xz"), (b"!\n", "unsupported"), (b"!\n", "unsupported"), (b"\xed\xab\xee\xdb", "unsupported"), (b"\x28\xb5\x2f\xfd", "unsupported"), (b"7z\xbc\xaf\x27\x1c", "unsupported"), (b"Rar!\x1a\x07", "unsupported"), (b"\x04\x22\x4d\x18", "unsupported"), (b"LZIP", "unsupported"), (b"\x1f\x9d", "unsupported"), (b"MSCF", "unsupported"), (b"xar!", "unsupported"), (b"070701", "unsupported"), (b"070702", "unsupported"), (b"070707", "unsupported"), ) NODE_FIXES = {22: (22, 23, 4), 24: (24, 22, 1), 26: (26, 12, 1)} # Frozen from the Node.js release schedule on the advisory snapshot date. NODE_EOL_BRANCHES = {0, *range(4, 22), 23, 25} SKIPPABLE_FRAMES = tuple(bytes((first, 0x2A, 0x4D, 0x18)) for first in range(0x50, 0x60)) MANIFEST_NAMES = { "package.json", "package-lock.json", "npm-shrinkwrap.json", "yarn.lock", "pnpm-lock.yaml", "pom.xml", "build.gradle", "build.gradle.kts", "gradle.lockfile", "cargo.toml", "cargo.lock", "go.mod", "go.sum", "pyproject.toml", "requirements.txt", "uv.lock", "poetry.lock", "cmakelists.txt", "cmakecache.txt", "module.bazel", "module.bazel.lock", "workspace", "workspace.bazel", "deps", ".gitmodules", "vcpkg.json", "conanfile.txt", "conanfile.py", "bom.json", "metadata", "pkg-info", } UNDICI = re.compile(r"(?//[^\n]*|/\*[\s\S]*?\*/)" r"""|(?P'(?:\\.|[^'\\])*'|"(?:\\.|[^"\\])*")""" r"|(?P