lotobo/onenote-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 8 Wiki Activity

docs: record FSSHTTP package-store support

Browse Source
This commit is contained in:
Albrecht Degering
2026-07-22 19:28:38 +02:00
parent 268b7d01fd
commit f0f6e48188
6 changed files with 54 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
docs/SECURITY.md
View File

@@ -26,7 +26,7 @@ The application does not:
## Active default limits
The main thread rejects a source larger than 512 MiB before reading it. The
desktop section parser then applies these independent defaults:
OneStore section parsers then apply these independent defaults:
| Resource | Default limit |
| ------------------------------------- | -------------------: |
@@ -36,6 +36,7 @@ desktop section parser then applies these independent defaults:
| Objects | 500,000 |
| Properties per set / property nesting | 16,384 / 64 |
| Stream IDs | 1,000,000 |
| FSSHTTPB revision-chain entries | 16,384 |
| One property vector | 64 MiB |
| Object references | 1,000,000 |
| Content-graph depth | 256 |
@@ -78,7 +79,12 @@ most the current and next compressed block so a synthetic `0xFF` sentinel can
be consumed without buffering a complete folder. CAB extraction checks
cancellation during Quantum work and yields between data blocks so the worker
can process termination. Desktop OneStore traversal checks fragment/reference
cycles, nesting, object/property/reference counts, and byte ranges.
cycles, nesting, object/property/reference counts, and byte ranges. FSSHTTPB
parsing bounds every declared stream body and compact integer, rejects invalid
end markers and non-zero package tails, checks mapping/reference counts and
revision cycles, and retains BLOB payloads as bounded source ranges. Fragment
records are range-checked, but packages containing them are rejected because
fragmented-element reconstruction is not implemented.
## Rendering and links
@@ -89,7 +95,7 @@ explicit user action, scheme validation, and safe navigation attributes.
## Known gaps and roadmap
- There is no wall-clock deadline. Synchronous desktop `.one` parsing cannot
- There is no wall-clock deadline. Synchronous OneStore `.one` parsing cannot
observe cooperative cancellation until control returns; terminating the
worker is the current hard stop.
- The package flow holds the source, decompressed folder buffers, extracted