mirror of
https://github.com/FreshRSS/FreshRSS.git
synced 2026-10-28 14:08:45 -04:00
GigiandAlexandre Alapetite
cd42dc7509
* importExport: bound ZIP import against decompression bombs ZIP import read every archive member into memory via getFromIndex() with no limit on member count, per-member or total uncompressed size, or compression ratio, so a small crafted upload could exhaust memory (CWE-409). Enforce a member-count limit, per-member and aggregate uncompressed-size limits and a compression-ratio ceiling from the central-directory metadata, and additionally cap the real decompressed size while streaming each member (the declared size is attacker-controlled and can under-report). Oversized or over-compressed members are skipped and the loop stops once the budget is reached; a realistic export (an OPML plus a few JSON files) stays well within the limits. * Fix lookup by name and total calculation * Fix locateName regression Duplicate entry name: keep only the first occurrence, but allow full paths --------- Co-authored-by: Alexandre Alapetite <alexandre@alapetite.fr>