fix(score): validate PDF bridge byte arrays without coercion

CHANGELOG.md

@@ -9,12 +9,11 @@
 - 각 합주 역할(Role)별 개인 연습 진행도를 0~100% 범위로 기록 및 시각화할 수 있는 연습 진척도(`practiceProgress`) 트래커 기능 추가. UI 컨트롤(슬라이더 및 +/- 버튼)과 한/영 다국어 지원 포함.
 
 ### Changed
-
 - Pinned npm `10.9.9` as the approved lockfile generator, activated it through Node-bundled Corepack before dependency consumption, and fail closed unless its bundled `tar` is at least `7.5.19`; primary CI still consumes the committed lock only through frozen `npm ci` validation, rejects mutable npm resolution in the lock gate, requires integrity evidence for public-registry lock entries, and preserves generator-sensitive root `@esbuild/*` peer metadata.
-
+- Upgraded the local score PDF parser to `pdfjs-dist` 6.2.108, pinned Undici 7.29.0 across the workspace, and constrained PDF loading to copied in-memory bytes with a same-origin bundled worker and npm-generated lock provenance.
 ### Fixed
 
-- Upgraded the local score PDF parser to `pdfjs-dist` 6.2.108, pinned Undici 7.29.0 across the workspace, and constrained PDF loading to copied in-memory bytes with a same-origin bundled worker and npm-generated lock provenance.
+- Reject malformed, shorter-than-`%PDF-`, or oversized PDF bridge responses before allocation/copy, enforcing the desktop bridge's 5-byte PDF-magic minimum and 25 MiB cap while snapshotting attach metadata, array length, and every returned PDF byte during authoritative reads or into fresh owned buffers so coercion, accessor-driven changes, or later bridge-side mutation cannot change validated results.
 
 ## [0.1.3] - 2026-04-29
 

apps/desktop/src/features/score/ScoreView.test.tsx

@@ -47,6 +47,7 @@ const tauriWindow = window as TauriWindow;
 const mockInvoke = vi.mocked(invoke);
 
 const SCORE_ID = "3f2c8f0e-1a2b-4c3d-8e9f-001122334455";
+const MINIMAL_PDF_BYTES = [37, 80, 68, 70, 45] as const;
 
 function makeSong(scoreAttachments?: ScoreAttachment[]): RehearsalSong {
   return {
@@ -106,7 +107,7 @@ describe("ScoreView", () => {
   it("attaches a score, persists the metadata, and opens the new PDF", async () => {
     mockInvoke
       .mockResolvedValueOnce(attachResponse())
-      .mockResolvedValueOnce([1, 2, 3]);
+      .mockResolvedValueOnce([...MINIMAL_PDF_BYTES]);
     const onSongUpdate = vi.fn();
     const song = makeSong();
 
@@ -115,7 +116,7 @@ describe("ScoreView", () => {
     fireEvent.click(screen.getByRole("button", { name: "Add score" }));
 
     await waitFor(() => {
-      expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:3:opener.pdf");
+      expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:5:opener.pdf");
     });
     expect(mockInvoke).toHaveBeenNthCalledWith(1, "attach_score_pdf", {
       projectId: "project-1-2",
@@ -157,7 +158,7 @@ describe("ScoreView", () => {
   });
 
   it("opens an existing attachment through the read command", async () => {
-    const bytes = new Uint8Array([9, 9, 9, 9]).buffer;
+    const bytes = new Uint8Array(MINIMAL_PDF_BYTES).buffer;
     let resolveRead!: (value: unknown) => void;
     mockInvoke.mockImplementationOnce(
       () => new Promise((resolve) => { resolveRead = resolve; })
@@ -172,7 +173,7 @@ describe("ScoreView", () => {
     resolveRead(bytes);
 
     await waitFor(() => {
-      expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:4:opener.pdf");
+      expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:5:opener.pdf");
     });
     expect(mockInvoke).toHaveBeenCalledWith("read_score_pdf", {
       projectId: "project-1-2",
@@ -181,15 +182,15 @@ describe("ScoreView", () => {
   });
 
   it("accepts Uint8Array read responses from the bridge", async () => {
-    mockInvoke.mockResolvedValueOnce(new Uint8Array([7, 7]));
+    mockInvoke.mockResolvedValueOnce(new Uint8Array(MINIMAL_PDF_BYTES));
     const song = makeSong([{ id: SCORE_ID, fileName: "opener.pdf" }]);
 
     render(<ScoreView song={song} projectId="project-1-2" onSongUpdate={vi.fn()} />);
 
     fireEvent.click(screen.getByRole("button", { name: "Open score: opener.pdf" }));
 
     await waitFor(() => {
-      expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:2:opener.pdf");
+      expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:5:opener.pdf");
     });
   });
 
@@ -222,7 +223,7 @@ describe("ScoreView", () => {
 
   it("removes an attachment after confirmation and resets the open viewer", async () => {
     mockInvoke
-      .mockResolvedValueOnce([1, 2])
+      .mockResolvedValueOnce([...MINIMAL_PDF_BYTES])
       .mockResolvedValueOnce(true);
     vi.spyOn(window, "confirm").mockReturnValue(true);
     const onSongUpdate = vi.fn();
@@ -232,7 +233,7 @@ describe("ScoreView", () => {
 
     fireEvent.click(screen.getByRole("button", { name: "Open score: opener.pdf" }));
     await waitFor(() => {
-      expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:2:opener.pdf");
+      expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:5:opener.pdf");
     });
 
     fireEvent.click(screen.getByRole("button", { name: "Remove: opener.pdf" }));
@@ -307,7 +308,7 @@ describe("ScoreView", () => {
 
   it("uses the legacy invoke shim when Tauri internals are absent", async () => {
     delete tauriWindow.__TAURI_INTERNALS__;
-    const legacyInvoke = vi.fn().mockResolvedValueOnce([5]);
+    const legacyInvoke = vi.fn().mockResolvedValueOnce([...MINIMAL_PDF_BYTES]);
     tauriWindow.__TAURI_INVOKE__ = legacyInvoke;
     const song = makeSong([{ id: SCORE_ID, fileName: "opener.pdf" }]);
 
@@ -316,7 +317,7 @@ describe("ScoreView", () => {
     fireEvent.click(screen.getByRole("button", { name: "Open score: opener.pdf" }));
 
     await waitFor(() => {
-      expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:1:opener.pdf");
+      expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:5:opener.pdf");
     });
     expect(legacyInvoke).toHaveBeenCalledWith("read_score_pdf", {
       projectId: "project-1-2",
@@ -344,7 +345,7 @@ describe("ScoreView", () => {
     let resolveStale!: (value: unknown) => void;
     mockInvoke
       .mockImplementationOnce(() => new Promise((resolve) => { resolveStale = resolve; }))
-      .mockResolvedValueOnce([9, 9]);
+      .mockResolvedValueOnce([...MINIMAL_PDF_BYTES]);
     const song = makeSong([
       { id: "id-1", fileName: "first.pdf" },
       { id: "id-2", fileName: "second.pdf" }
@@ -356,14 +357,14 @@ describe("ScoreView", () => {
     fireEvent.click(screen.getByRole("button", { name: "Open score: second.pdf" }));
 
     await waitFor(() => {
-      expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:2:second.pdf");
+      expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:5:second.pdf");
     });
 
     await act(async () => {
       resolveStale([1, 1, 1, 1, 1]);
     });
 
-    expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:2:second.pdf");
+    expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:5:second.pdf");
     expect(screen.queryByRole("alert")).not.toBeInTheDocument();
   });
 
@@ -373,7 +374,7 @@ describe("ScoreView", () => {
     let rejectStale!: (reason: unknown) => void;
     mockInvoke
       .mockImplementationOnce(() => new Promise((_resolve, reject) => { rejectStale = reject; }))
-      .mockResolvedValueOnce([4, 4]);
+      .mockResolvedValueOnce([...MINIMAL_PDF_BYTES]);
     const song = makeSong([
       { id: "id-1", fileName: "first.pdf" },
       { id: "id-2", fileName: "second.pdf" }
@@ -385,14 +386,14 @@ describe("ScoreView", () => {
     fireEvent.click(screen.getByRole("button", { name: "Open score: second.pdf" }));
 
     await waitFor(() => {
-      expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:2:second.pdf");
+      expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:5:second.pdf");
     });
 
     await act(async () => {
       rejectStale(new Error("Stale read failed."));
     });
 
-    expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:2:second.pdf");
+    expect(screen.getByTestId("score-viewer")).toHaveTextContent("bytes:5:second.pdf");
     expect(screen.queryByRole("alert")).not.toBeInTheDocument();
   });
 

apps/desktop/src/features/score/scoreStorage.minimum-size.test.ts

@@ -0,0 +1,67 @@
+import { afterEach, expect, it, vi } from "vitest";
+
+import { attachScorePdf, readScorePdf } from "./scoreStorage";
+
+const INVALID_RESPONSE_MESSAGE = "Invalid score bridge response";
+const MAX_SCORE_PDF_BYTES = 25 * 1024 * 1024;
+
+function stubReadResponse(response: unknown): void {
+  vi.stubGlobal("window", {
+    __TAURI_INTERNALS__: {
+      invoke: async () => response
+    }
+  });
+}
+
+afterEach(() => {
+  vi.unstubAllGlobals();
+});
+
+it.each([0, 4])(
+  "rejects attach metadata smaller than the Rust PDF magic boundary (%i bytes)",
+  async (fileSizeBytes) => {
+    stubReadResponse({ scoreId: "score-1", fileName: "score.pdf", fileSizeBytes });
+
+    await expect(attachScorePdf("project-1", "song-1")).rejects.toThrow(
+      INVALID_RESPONSE_MESSAGE
+    );
+  }
+);
+
+it.each([
+  ["numeric array", [0, 1, 2, 3]],
+  ["Uint8Array", new Uint8Array([0, 1, 2, 3])],
+  ["ArrayBuffer", new Uint8Array([0, 1, 2, 3]).buffer]
+])("rejects a %s bridge payload shorter than the PDF magic boundary", async (_label, response) => {
+  stubReadResponse(response);
+
+  await expect(readScorePdf("project-1", "score-1")).rejects.toThrow(
+    INVALID_RESPONSE_MESSAGE
+  );
+});
+
+it("rejects an oversized Uint8Array even when an own byteLength accessor lies", async () => {
+  const response = new Uint8Array(MAX_SCORE_PDF_BYTES + 1);
+  Object.defineProperty(response, "byteLength", {
+    configurable: true,
+    get: () => 5
+  });
+  stubReadResponse(response);
+
+  await expect(readScorePdf("project-1", "score-1")).rejects.toThrow(
+    INVALID_RESPONSE_MESSAGE
+  );
+});
+
+it("rejects an oversized ArrayBuffer even when an own byteLength accessor lies", async () => {
+  const response = new ArrayBuffer(MAX_SCORE_PDF_BYTES + 1);
+  Object.defineProperty(response, "byteLength", {
+    configurable: true,
+    get: () => 5
+  });
+  stubReadResponse(response);
+
+  await expect(readScorePdf("project-1", "score-1")).rejects.toThrow(
+    INVALID_RESPONSE_MESSAGE
+  );
+});