release: v0.2.1 生产加固 — WAL CRC/约束激活/Hybrid提交顺序/RESTRICT外键/浏览器兼容表/debug模式/onError回调

src/engine/aria/wal/log.ts

@@ -216,6 +216,7 @@ export class WAL {
 
     while (offset + 15 <= data.byteLength) {
       try {
+        const recordStart = offset;
         const lsn = view.getUint32(offset, false);
         offset += 4;
         const type = view.getUint8(offset) as WALRecordType;
@@ -225,16 +226,19 @@ export class WAL {
 
         const tableLen = view.getUint16(offset, false);
         offset += 2;
+        if (offset + tableLen > data.byteLength) break;
         const tableName = new TextDecoder().decode(data.slice(offset, offset + tableLen));
         offset += tableLen;
 
         const keyLen = view.getUint16(offset, false);
         offset += 2;
+        if (offset + keyLen > data.byteLength) break;
         const key = new TextDecoder().decode(data.slice(offset, offset + keyLen));
         offset += keyLen;
 
         const jsonLen = view.getUint32(offset, false);
         offset += 4;
+        if (offset + jsonLen > data.byteLength) break;
         let recordData: Record<string, unknown> | undefined;
         if (jsonLen > 0) {
           const json = new TextDecoder().decode(data.slice(offset, offset + jsonLen));
@@ -244,8 +248,19 @@ export class WAL {
         }
         offset += jsonLen;
 
-        // 跳过 CRC
+        // 验证 CRC（跨记录数据计算，不含 CRC 自身）
+        const storedCrc = view.getUint32(offset, false);
         offset += 4;
+        const recordBytes = data.slice(recordStart, offset - 4);
+        let computedCrc = 0;
+        for (let i = 0; i < recordBytes.length; i++) {
+          computedCrc = ((computedCrc << 5) - computedCrc + recordBytes[i]) | 0;
+        }
+        if ((computedCrc >>> 0) !== storedCrc) {
+          // CRC 不匹配，跳过此损坏记录
+          console.warn(`[AriaEngine WAL] CRC mismatch at record LSN=${lsn}, skipping`);
+          continue;
+        }
 
         records.push({
           lsn,
@@ -254,7 +269,7 @@ export class WAL {
           tableName,
           key,
           data: recordData,
-          checksum: 0,
+          checksum: storedCrc,
         });
       } catch {
         break;