fix(tools): report deeply nested JSON as invalid input and run the reserved-name archive test

tools/hw-oracle/compare_results.py

@@ -14,7 +14,10 @@ def integer(value, minimum, maximum):
 
 
 def read_report(path):
-    report = json.loads(path.read_text(encoding="utf-8-sig"))
+    try:
+        report = json.loads(path.read_text(encoding="utf-8-sig"))
+    except RecursionError as error:
+        raise ValueError(f"{path}: JSON nested too deeply") from error
     if not isinstance(report, dict):
         raise ValueError(f"{path}: expected a JSON object")
     required = {"schema_version", "assembly_target", "rows", *SETTINGS}

tools/hw-oracle/test_compare_results.py

@@ -33,6 +33,15 @@ def test_utf8_bom_and_crlf_keep_identical_and_different_results(self):
                     self.assertEqual(result.returncode, int(different), result.stdout + result.stderr)
                     self.assertEqual(result.stderr, "")
 
+    def test_deeply_nested_json_is_an_invalid_report_not_a_difference(self):
+        self.before.write_text(json.dumps(self.report), encoding="utf-8")
+        self.after.write_text("[" * 200000, encoding="utf-8")
+        result = subprocess.run([sys.executable, str(SCRIPT), str(self.before), str(self.after)],
+                                capture_output=True, text=True, timeout=30)
+        self.assertEqual(result.returncode, 2, result.stdout + result.stderr)
+        self.assertIn("nested too deeply", result.stderr)
+        self.assertNotIn("Traceback", result.stderr)
+
     def test_bom_does_not_hide_invalid_json_or_invalid_reports(self):
         self.before.write_text(json.dumps(self.report), encoding="utf-8")
         for payload in ("{", "[]", '{"schema_version": 2}'):

tools/import_audit.py

@@ -656,7 +656,7 @@ def source_stub_classes(source):
 def read_registry(path):
     try:
         entries = json.loads(Path(path).read_text(encoding="utf-8-sig"))
-    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as error:
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError, RecursionError) as error:
         raise AuditError(f"{path}: cannot read registry: {error}") from error
     if not isinstance(entries, list):
         raise AuditError(f"{path}: a registry is a JSON list, got {type(entries).__name__}")
@@ -681,7 +681,7 @@ def needed_registry_path(path):
 def read_needed_registry(path):
     try:
         libraries = json.loads(path.read_text(encoding="utf-8-sig"))
-    except (OSError, UnicodeDecodeError, json.JSONDecodeError) as error:
+    except (OSError, UnicodeDecodeError, json.JSONDecodeError, RecursionError) as error:
         raise AuditError(f"{path}: cannot read needed libraries: {error}") from error
     if not isinstance(libraries, list) or any(not isinstance(library, str) or not library for library in libraries):
         raise AuditError(f"{path}: needed libraries must be a JSON list of nonempty strings")

tools/test_web.py

@@ -44,6 +44,7 @@ def main(argv=None):
             environment = dict(os.environ, ANYPS5_TEST_ZIP_URL=url, ANYPS5_TEST_ZIP_PATH=library.as_uri())
             subprocess.run(["node", str(ROOT / "demo/web/tests/archive-root.test.mjs"), str(args.build.resolve() / "web")], env=environment, check=True)
             subprocess.run(["node", str(ROOT / "demo/web/tests/archive-windows.test.mjs"), str(args.build.resolve() / "web")], env=environment, check=True)
+            subprocess.run(["node", str(ROOT / "demo/web/tests/archive-reserved.test.mjs"), str(args.build.resolve() / "web")], env=environment, check=True)
             subprocess.run(["node", str(ROOT / "demo/web/tests/archive.test.mjs"), str(args.build.resolve() / "web"), str(fixture)], env=environment, check=True)
     except (subprocess.CalledProcessError, urllib.error.URLError, OSError) as error:
         parser.error(str(error))

tools/tests/test_import_audit.py

@@ -242,6 +242,18 @@ def test_cli_error_paths_are_utf8_under_an_ascii_environment(self):
         self.assertEqual(result.stdout, b"")
 
 
+    def test_deeply_nested_registries_are_audit_errors(self):
+        registry = self.work.root / "game.registry.json"
+        registry.write_text("[" * 200000, encoding="utf-8")
+        code, out, err = self.work.run(registry)
+        self.assertEqual(code, 2, err)
+        self.assertIn("cannot read registry", err)
+        registry.write_text("[]", encoding="utf-8")
+        registry.with_name("game.needed.json").write_text("[" * 200000, encoding="utf-8")
+        code, out, err = self.work.run(registry)
+        self.assertEqual(code, 2, err)
+        self.assertIn("cannot read needed libraries", err)
+
     def test_windows_guest_dependencies_use_host_prx_suffixes(self):
         work = self.work
         (work.libs / "libSceA.prx").write_bytes(build_pe(["AAAAAAAAAAA"]))