Scope
Security: remediate the bundled PCRE 8.31 vulnerabilities:
This is the largest real vuln but is deferred because it is NDK/native-touching and changes native behavior. The Tier-3 RegExpNative test (issue #2) is the safety net that makes this tractable.
Steps
Estimate
~12–30 h — research/options 3–5 · implement 8–20 · migrate JNI 2–4 · suite+device 1–2
Notes / what to capture
- Bundled parser is reachable from user input (regex) and loaded dictionary data — document the input-trust model.
- App is fully offline (no INTERNET permission) → smaller attack surface, but the native parser is still exposed to questionable input.
- May effectively merge with the step-2d NDK decision: if NDK r28c already forces a PCRE re-port, do this work there instead.
- Keep the Tier-3
RegExpNative test passing as the equivalence guard across the re-port.
Scope
Security: remediate the bundled PCRE 8.31 vulnerabilities:
This is the largest real vuln but is deferred because it is NDK/native-touching and changes native behavior. The Tier-3
RegExpNativetest (issue #2) is the safety net that makes this tractable.Steps
SUPPORT_JITundef,PARENS_NEST_LIMIT 250)RegExpNative.java+ native callers accordingly (no JNI change needed — drop-in swap)Estimate
~12–30 h — research/options 3–5 · implement 8–20 · migrate JNI 2–4 · suite+device 1–2
Notes / what to capture
RegExpNativetest passing as the equivalence guard across the re-port.