fix(compiler): harden HoloQR payload admission

PASS: pnpm check:holoqr-born-from-source

PASS: pnpm holoqr:build-release

PASS: QrPayloadFactsTest (2 tests, 0 failures)

PASS: apksigner verify --verbose

Author: brianonbased-dev

apps/quest-universal-qr-scanner/android-mr/app/src/main/java/net/holoscript/qrscanner/StarterSampleActivity.kt

@@ -65,7 +65,7 @@ internal object QrPayloadFacts {
     return lines.size >= 3 &&
         lines.first().trim().equals(begin, ignoreCase = true) &&
         lines.last().trim().equals(end, ignoreCase = true) &&
-        lines.subList(1, lines.lastIndex).any { line ->
+        lines.subList(1, lines.lastIndex).all { line ->
           val separator = line.indexOf(':')
           separator > 0 && separator < line.lastIndex
         }
@@ -93,10 +93,10 @@ internal object QrPayloadFacts {
     if (trimmed.startsWith("BEGIN:VEVENT", ignoreCase = true)) {
       return validStructuredEnvelope(trimmed, "BEGIN:VEVENT", "END:VEVENT")
     }
-    val declaresWebUrl =
-        trimmed.startsWith("http://", ignoreCase = true) ||
-            trimmed.startsWith("https://", ignoreCase = true)
-    if (!declaresWebUrl) return true
+    val declaresWebScheme =
+        trimmed.startsWith("http:", ignoreCase = true) ||
+            trimmed.startsWith("https:", ignoreCase = true)
+    if (!declaresWebScheme) return true
     val uri = try { URI(trimmed).parseServerAuthority() } catch (_: Exception) { return false }
     val validPort = uri.port == -1 || uri.port in 1..65535
     return (uri.scheme.equals("http", true) || uri.scheme.equals("https", true)) &&

apps/quest-universal-qr-scanner/android-mr/app/src/test/java/net/holoscript/qrscanner/QrPayloadFactsTest.kt

@@ -8,6 +8,7 @@ class QrPayloadFactsTest {
   @Test
   fun rejectsMalformedOrAmbiguousWebAuthorities() {
     assertFalse(QrPayloadFacts.syntaxSafe("https://"))
+    assertFalse(QrPayloadFacts.syntaxSafe("https:/example.com"))
     assertFalse(QrPayloadFacts.syntaxSafe("https://example.com:bad"))
     assertFalse(QrPayloadFacts.syntaxSafe("https://user@example.com/path"))
     assertFalse(QrPayloadFacts.syntaxSafe("https://example.com:70000/path"))
@@ -19,6 +20,7 @@ class QrPayloadFactsTest {
     assertFalse(QrPayloadFacts.controlsSafe("https://example.com/\nextra"))
     assertFalse(QrPayloadFacts.controlsSafe("plain\ttext"))
     assertFalse(QrPayloadFacts.syntaxSafe("BEGIN:VCARD\nnot-a-card"))
+    assertFalse(QrPayloadFacts.syntaxSafe("BEGIN:VCARD\nFN:Ada\ngarbage\nEND:VCARD"))
     assertTrue(QrPayloadFacts.controlsSafe("BEGIN:VCARD\r\nFN:Ada\r\nEND:VCARD"))
     assertTrue(QrPayloadFacts.syntaxSafe("BEGIN:VCARD\r\nFN:Ada\r\nEND:VCARD"))
     assertTrue(QrPayloadFacts.controlsSafe("BEGIN:VEVENT\nSUMMARY:Launch\nEND:VEVENT"))

apps/quest-universal-qr-scanner/scripts/build-release.mjs

@@ -140,8 +140,15 @@ export async function main(argv = process.argv.slice(2)) {
   // Windows batch files must run through cmd.exe. Pass the absolute path and avoid shell:true.
   const cmd = isWin ? 'cmd.exe' : gradlewPath;
   const args = isWin
-    ? ['/c', gradlewPath, ':app:assembleRelease', '--console=plain', '--no-daemon']
-    : [':app:assembleRelease', '--console=plain', '--no-daemon'];
+    ? [
+        '/c',
+        gradlewPath,
+        ':app:testDebugUnitTest',
+        ':app:assembleRelease',
+        '--console=plain',
+        '--no-daemon',
+      ]
+    : [':app:testDebugUnitTest', ':app:assembleRelease', '--console=plain', '--no-daemon'];
 
   try {
     const result = spawnSync(cmd, args, {

packages/core/src/compiler/quest-mr-templates.generated.ts

@@ -65,7 +65,7 @@ internal object QrPayloadFacts {
     return lines.size >= 3 &&
         lines.first().trim().equals(begin, ignoreCase = true) &&
         lines.last().trim().equals(end, ignoreCase = true) &&
-        lines.subList(1, lines.lastIndex).any { line ->
+        lines.subList(1, lines.lastIndex).all { line ->
           val separator = line.indexOf(':')
           separator > 0 && separator < line.lastIndex
         }
@@ -93,10 +93,10 @@ internal object QrPayloadFacts {
     if (trimmed.startsWith("BEGIN:VEVENT", ignoreCase = true)) {
       return validStructuredEnvelope(trimmed, "BEGIN:VEVENT", "END:VEVENT")
     }
-    val declaresWebUrl =
-        trimmed.startsWith("http://", ignoreCase = true) ||
-            trimmed.startsWith("https://", ignoreCase = true)
-    if (!declaresWebUrl) return true
+    val declaresWebScheme =
+        trimmed.startsWith("http:", ignoreCase = true) ||
+            trimmed.startsWith("https:", ignoreCase = true)
+    if (!declaresWebScheme) return true
     val uri = try { URI(trimmed).parseServerAuthority() } catch (_: Exception) { return false }
     val validPort = uri.port == -1 || uri.port in 1..65535
     return (uri.scheme.equals("http", true) || uri.scheme.equals("https", true)) &&