Skip to content

Harden DemoType input processing - #67

Merged
Mario Hewardt (MarioHewardt) merged 2 commits into
mainfrom
ryanwaite-openssf-security-assessment
Sep 18, 2026
Merged

Mario Hewardt (MarioHewardt) merged 2 commits into
mainfrom
ryanwaite-openssf-security-assessment

Conversation

@ryanwaite

Copy link
Copy Markdown
Contributor

Fixes #66

Summary

  • clean DemoType control markers without reusing String.Index values after mutation
  • bound pause durations and guard nanosecond conversion against overflow
  • replay text using complete UTF-16 sequences so non-BMP characters are handled correctly
  • add regression coverage for EOF markers, repeated controls, pause bounds, and surrogate pairs

Validation

  • swift run ZoomItMacSelfTest
  • swift run -c release ZoomItMacSelfTest
  • swift run -Xswiftc -DZOOMIT_APP_STORE ZoomItMacSelfTest

Prevent stale String.Index reuse, bound pause durations, and replay text as complete UTF-16 sequences so non-BMP characters do not trap.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot AI lite review requested due to automatic review settings September 16, 2026 21:11

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔵 Needs a closer look

Long graphemes may exceed the 20 UTF-16-unit event limit and be truncated.

Pull request overview

Harden DemoType parsing, pause handling, and Unicode text replay with regression coverage.

Changes:

  • Removed stale string-index usage during control-marker cleanup.
  • Added pause bounds and overflow protection.
  • Improved UTF-16 replay and edge-case tests.
File summaries
File Summary
Sources/ZoomItMacCore/SelfTest/SelfTestRunner.swift Added regression tests for controls, pauses, and Unicode handling.
Sources/ZoomItMacCore/App/DemoTypeController.swift Hardened parsing and replay; long graphemes still require chunking to avoid truncation.
Review details

Suppressed comments (1)

Sources/ZoomItMacCore/App/DemoTypeController.swift:557

  • CGEvent.keyboardSetUnicodeString is limited to 20 UTF-16 code units per event, but a valid Swift Character can contain more than 20 units (for example, a base scalar followed by many combining marks). Passing the entire grapheme here can truncate that text, so split long input into API-sized chunks without splitting surrogate pairs (and add a regression case for a long grapheme).
            down?.keyboardSetUnicodeString(stringLength: buffer.count, unicodeString: baseAddress)
            let up = CGEvent(keyboardEventSource: source, virtualKey: 0, keyDown: false)
            up?.keyboardSetUnicodeString(stringLength: buffer.count, unicodeString: baseAddress)
  • Files reviewed: 2/2 changed files
  • Comments generated: 0
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

Keep each CoreGraphics Unicode event to one scalar while preserving surrogate pairs and long combining graphemes.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings September 17, 2026 21:45
@ryanwaite

Copy link
Copy Markdown
Contributor Author

Addressed the Unicode event-length concern in adff901. DemoType now posts one CoreGraphics keyboard event pair per Unicode scalar, so each event contains at most two UTF-16 code units and never splits a surrogate pair. The scalar sequence—and therefore combining graphemes longer than 20 UTF-16 units—is preserved across the emitted events.

Added regression coverage for BMP text, a non-BMP emoji, and a 25-scalar combining grapheme. Validation passed with:

  • swift run ZoomItMacSelfTest
  • swift run -c release ZoomItMacSelfTest
  • swift run -Xswiftc -DZOOMIT_APP_STORE ZoomItMacSelfTest

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

No unresolved blocking issues were identified.

Review details
  • Files reviewed: 2/2 changed files
  • Comments generated: 0 new
  • Review effort level: Lite

@MarioHewardt
Mario Hewardt (MarioHewardt) merged commit 1ed6a07 into main Sep 18, 2026
4 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

[Bug]: DemoType crashes on some scripts and Unicode text

3 participants