.github/workflows/benchmark.yml

@@ -12,11 +12,11 @@ jobs:
     steps:
     # Base for comparison is master branch.
     - name: Checkout code
-      uses: actions/checkout@v4.2.1
+      uses: actions/checkout@v4.2.2
       with:
         ref: master
     - name: Install Go
-      uses: actions/setup-go@v5.0.2
+      uses: actions/setup-go@v5.1.0
       with:
         go-version-file: 'go.mod'
 
@@ -25,7 +25,7 @@ jobs:
     # runner is in a shared environment and CPU and mem would be affected by others. (or so I think)
     - run: go test -run=none -bench=. -count=30 -benchtime=100ms -timeout=20m > /tmp/prev
     - name: Checkout code
-      uses: actions/checkout@v4.2.1
+      uses: actions/checkout@v4.2.2
     - run: go test -run=none -bench=. -count=30 -benchtime=100ms -timeout=20m > /tmp/curr
 
     - run: go install golang.org/x/perf/cmd/benchstat@latest

.github/workflows/codeql.yml

@@ -20,13 +20,13 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v4.2.1
+        uses: actions/checkout@v4.2.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v3.26.12
+        uses: github/codeql-action/init@v3.27.1
         with:
           languages: go
           queries: security-and-quality
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v3.26.12
+        uses: github/codeql-action/analyze@v3.27.1

.github/workflows/go.yml

@@ -13,9 +13,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4.2.1
+      uses: actions/checkout@v4.2.2
     - name: Install Go
-      uses: actions/setup-go@v5.0.2
+      uses: actions/setup-go@v5.1.0
       with:
         go-version-file: 'go.mod'
     - name: Run linters
@@ -27,10 +27,10 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout code
-      uses: actions/checkout@v4.2.1
+      uses: actions/checkout@v4.2.2
     - name: Install Go
       if: success()
-      uses: actions/setup-go@v5.0.2
+      uses: actions/setup-go@v5.1.0
       with:
         go-version-file: 'go.mod'
     - run: go test -race ./...

go.mod

@@ -2,7 +2,7 @@ module github.com/gabriel-vasile/mimetype
 
 go 1.20
 
-require golang.org/x/net v0.30.0
+require golang.org/x/net v0.31.0
 
 // v1.4.4 had a test file detected as malicious by antivirus software. #575
 retract v1.4.4

go.sum

@@ -1,2 +1,2 @@
-golang.org/x/net v0.30.0 h1:AcW1SDZMkb8IpzCdQUaIq2sP4sZ4zw+55h6ynffypl4=
-golang.org/x/net v0.30.0/go.mod h1:2wGyMJ5iFasEhkwi13ChkO/t1ECNC4X4eBKkVFyYFlU=
+golang.org/x/net v0.31.0 h1:68CPQngjLL0r2AlUKiSxtQFKvzRVbnzLwMUn5SzcLHo=
+golang.org/x/net v0.31.0/go.mod h1:P4fl1q7dY2hnZFxEk4pPSkDHF+QqjitcnDjUQyMM+pM=

internal/magic/binary.go

@@ -23,6 +23,8 @@ var (
 	Torrent = prefix([]byte("d8:announce"))
 	// PAR1 matches a parquet file.
 	Par1 = prefix([]byte{0x50, 0x41, 0x52, 0x31})
+	// CBOR matches a Concise Binary Object Representation https://cbor.io/
+	CBOR = prefix([]byte{0xD9, 0xD9, 0xF7})
 )
 
 // Java bytecode and Mach-O binaries share the same magic number.
@@ -34,7 +36,7 @@ func classOrMachOFat(in []byte) bool {
 		return false
 	}
 
-	return bytes.HasPrefix(in, []byte{0xCA, 0xFE, 0xBA, 0xBE})
+	return binary.BigEndian.Uint32(in) == macho.MagicFat
 }
 
 // Class matches a java class file.
@@ -44,7 +46,7 @@ func Class(raw []byte, limit uint32) bool {
 
 // MachO matches Mach-O binaries format.
 func MachO(raw []byte, limit uint32) bool {
-	if classOrMachOFat(raw) && raw[7] < 20 {
+	if classOrMachOFat(raw) && raw[7] < 0x14 {
 		return true
 	}
 
@@ -156,11 +158,11 @@ func Marc(raw []byte, limit uint32) bool {
 // the GL transmission Format (glTF).
 // GLB uses little endian and its header structure is as follows:
 //
-// 	<-- 12-byte header                             -->
-// 	| magic            | version          | length   |
-// 	| (uint32)         | (uint32)         | (uint32) |
-// 	| \x67\x6C\x54\x46 | \x01\x00\x00\x00 | ...      |
-// 	| g   l   T   F    | 1                | ...      |
+//	<-- 12-byte header                             -->
+//	| magic            | version          | length   |
+//	| (uint32)         | (uint32)         | (uint32) |
+//	| \x67\x6C\x54\x46 | \x01\x00\x00\x00 | ...      |
+//	| g   l   T   F    | 1                | ...      |
 //
 // Visit [glTF specification] and [IANA glTF entry] for more details.
 //
@@ -172,14 +174,15 @@ var Glb = prefix([]byte("\x67\x6C\x54\x46\x02\x00\x00\x00"),
 // TzIf matches a Time Zone Information Format (TZif) file.
 // See more: https://tools.ietf.org/id/draft-murchison-tzdist-tzif-00.html#rfc.section.3
 // Its header structure is shown below:
-// 	+---------------+---+
-// 	|  magic    (4) | <-+-- version (1)
-// 	+---------------+---+---------------------------------------+
-// 	|           [unused - reserved for future use] (15)         |
-// 	+---------------+---------------+---------------+-----------+
-// 	|  isutccnt (4) |  isstdcnt (4) |  leapcnt  (4) |
-// 	+---------------+---------------+---------------+
-// 	|  timecnt  (4) |  typecnt  (4) |  charcnt  (4) |
+//
+//	+---------------+---+
+//	|  magic    (4) | <-+-- version (1)
+//	+---------------+---+---------------------------------------+
+//	|           [unused - reserved for future use] (15)         |
+//	+---------------+---------------+---------------+-----------+
+//	|  isutccnt (4) |  isstdcnt (4) |  leapcnt  (4) |
+//	+---------------+---------------+---------------+
+//	|  timecnt  (4) |  typecnt  (4) |  charcnt  (4) |
 func TzIf(raw []byte, limit uint32) bool {
 	// File is at least 44 bytes (header size).
 	if len(raw) < 44 {

internal/magic/magic_test.go

@@ -13,76 +13,100 @@ func TestMagic(t *testing.T) {
 		raw      string
 		limit    uint32
 		res      bool
-	}{
-		{
-			name:     "incomplete JSON, limit 0",
-			detector: JSON,
-			raw:      `["an incomplete JSON array`,
-			limit:    0,
-			res:      false,
-		},
-		{
-			name:     "incomplete JSON, limit 10",
-			detector: JSON,
-			raw:      `["an incomplete JSON array`,
-			limit:    10,
-			res:      true,
-		},
-		{
-			name:     "basic JSON data type null",
-			detector: JSON,
-			raw:      `null`,
-			limit:    10,
-			res:      false,
-		},
-		{
-			name:     "basic JSON data type string",
-			detector: JSON,
-			raw:      `"abc"`,
-			limit:    10,
-			res:      false,
-		},
-		{
-			name:     "basic JSON data type integer",
-			detector: JSON,
-			raw:      `120`,
-			limit:    10,
-			res:      false,
-		},
-		{
-			name:     "basic JSON data type float",
-			detector: JSON,
-			raw:      `.120`,
-			limit:    10,
-			res:      false,
-		},
-		{
-			name:     "NdJSON with basic data types",
-			detector: NdJSON,
-			raw:      "1\nnull\n\"foo\"\n0.1",
-			limit:    10,
-			res:      false,
-		},
-		{
-			name:     "NdJSON with basic data types and empty object",
-			detector: NdJSON,
-			raw:      "1\n2\n3\n{}",
-			limit:    10,
-			res:      true,
-		},
-		{
-			name:     "NdJSON with empty objects types",
-			detector: NdJSON,
-			raw:      "{}\n{}\n{}",
-			limit:    10,
-			res:      true,
-		},
-	}
+	}{{
+		name:     "incomplete JSON, limit 0",
+		detector: JSON,
+		raw:      `["an incomplete JSON array`,
+		limit:    0,
+		res:      false,
+	}, {
+		name:     "incomplete JSON, limit 10",
+		detector: JSON,
+		raw:      `["an incomplete JSON array`,
+		limit:    10,
+		res:      true,
+	}, {
+		name:     "basic JSON data type null",
+		detector: JSON,
+		raw:      `null`,
+		limit:    10,
+		res:      false,
+	}, {
+		name:     "basic JSON data type string",
+		detector: JSON,
+		raw:      `"abc"`,
+		limit:    10,
+		res:      false,
+	}, {
+		name:     "basic JSON data type integer",
+		detector: JSON,
+		raw:      `120`,
+		limit:    10,
+		res:      false,
+	}, {
+		name:     "basic JSON data type float",
+		detector: JSON,
+		raw:      `.120`,
+		limit:    10,
+		res:      false,
+	}, {
+		name:     "NdJSON with basic data types",
+		detector: NdJSON,
+		raw:      "1\nnull\n\"foo\"\n0.1",
+		limit:    10,
+		res:      false,
+	}, {
+		name:     "NdJSON with basic data types and empty object",
+		detector: NdJSON,
+		raw:      "1\n2\n3\n{}",
+		limit:    10,
+		res:      true,
+	}, {
+		name:     "NdJSON with empty objects types",
+		detector: NdJSON,
+		raw:      "{}\n{}\n{}",
+		limit:    10,
+		res:      true,
+	}, {
+		name:     "MachO class or Fat but last byte > \\x14",
+		detector: MachO,
+		raw:      "\xCA\xFE\xBA\xBE   \x15",
+		res:      false,
+	}, {
+		name:     "MachO class or Fat and last byte < \\x14",
+		detector: MachO,
+		raw:      "\xCA\xFE\xBA\xBE   \x13",
+		res:      true,
+	}, {
+		name:     "MachO BE Magic32",
+		detector: MachO,
+		raw:      "\xFE\xED\xFA\xCE",
+		res:      true,
+	}, {
+		name:     "MachO LE Magic32",
+		detector: MachO,
+		raw:      "\xCE\xFA\xED\xFE",
+		res:      true,
+	}, {
+		name:     "MachO BE Magic64",
+		detector: MachO,
+		raw:      "\xFE\xED\xFA\xCF",
+		res:      true,
+	}, {
+		name:     "MachO LE Magic64",
+		detector: MachO,
+		raw:      "\xCF\xFA\xED\xFE",
+		res:      true,
+	}}
 	for _, tt := range tCases {
 		t.Run(tt.name, func(t *testing.T) {
 			if got := tt.detector([]byte(tt.raw), tt.limit); got != tt.res {
 				t.Errorf("expected: %t; got: %t", tt.res, got)
 			}
+			// Empty inputs should not pass as anything.
+			if got := tt.detector(nil, 0); got != false {
+				t.Errorf("empty input: expected: %t; got: %t", false, got)
+			}
 		})
 	}
 }