Skip to content

Reject unknown or unsupported component sections instead of silently skipping them #7

Description

@JairusSW

Problem

decodeComponent's default section branch records any unrecognized section ID in RawSections and advances past it. ErrInvalidSectionID is defined but never used.

Relevant code: https://github.com/wago-org/component-model/blob/8a61139958e559a0ae61c3f49f6e9f33fddb6a95/internal/binary/decoder.go

For an execution engine, silently skipping an unknown or unsupported definition section is unsafe. Component sections contribute definitions to ordered index spaces and may carry required validation/instantiation semantics. Continuing as though the section were absent can shift every subsequent index or omit behavior while still returning a Component that the instantiator treats as decoded.

This also affects known-but-unimplemented format additions. For example, the current Component Model grammar includes a section-12 value definition behind a gated feature; a 0.2-only engine should reject it explicitly rather than skip it and attempt to instantiate the remaining component.

Impact

Malformed or unsupported components may pass decoding and reach compilation/instantiation with a structurally incomplete model. Depending on following aliases/canons/exports, this can produce misleading out-of-range failures, bind indices to the wrong definitions, or execute a component after silently discarding required semantics.

The engine claims compatibility with a pinned Component Model feature set, so fail-open forward compatibility is the wrong boundary here.

Suggested fix

  • Return ErrInvalidSectionID for IDs not present in the pinned format.
  • For a known section whose feature is not implemented, return a distinct unsupported component feature/section validation error.
  • Do not put semantic definition sections into RawSections; reserve raw skipping for custom section 0 only.
  • Add an explicit feature/version table so future format additions cannot become implicitly accepted through the default branch.

Regression tests

  • An arbitrary invalid ID such as 0xff must fail decode.
  • A syntactically valid but unsupported known section must fail with an unsupported-feature error.
  • A component placing aliases/exports after the skipped section must never reach instantiation.
  • Custom sections must continue to be accepted and skipped with strict size bounds.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions