Dery Ferdikaandbaron c59fbf5e9c fix(artifacts): bound archive decompression by source size (#2144) ...

* fix(artifacts): bound archive decompression by source size

A ZIP/APK/IPA/MSIX member is attacker-controlled and can expand far
beyond the archive that carries it. Inventory hashed every member to EOF
and extraction wrote every member with no ceiling, so a ~2 MiB archive
could drive ~30 s of CPU during inventory and ~150 s plus 2 GiB of disk
writes during extraction.

A fixed per-entry byte cap is the wrong shape: it rejects legitimately
large members inside large packages. The ceiling instead scales with the
archive's own size (500x, with a 256 MiB floor), so large packages keep a
proportionally large budget while a small archive cannot amplify into
unbounded work. The cumulative declared size is charged from the central
directory before any entry is decompressed, and zip.js already verifies
streamed output against each declaration, so the check is exact and
covers both inventory and extraction through the shared reader.

* fix(artifacts): own decompression accounting per traversal

* test(artifacts): verify declared ZIP output enforcement

---------

Co-authored-by: baron <richstyles@gmail.com>

2026-10-13 06:15:34 +09:00

..

apple

fix(apple): preserve slice identity and macOS boundary diagnostics (#1772)

2026-10-13 06:06:37 +09:00

extraction

fix(native): preserve universal Mach-O container identity

2026-10-12 09:29:07 +08:00

inventory

fix(artifacts): distinguish Java classes from universal Mach-O

2026-10-13 04:12:04 +08:00

javascript

feat(javascript): analyze selected application sources

2026-10-12 04:07:14 +08:00

ArtifactHash.ts

refactor(artifacts): isolate JavaScript file acquisition (#916)

2026-10-07 17:57:33 +08:00

ArtifactPaths.test.ts

perf(artifacts): reuse trie membership for case-folded siblings

2026-10-11 02:21:40 +08:00

ArtifactPaths.ts

perf(artifacts): reuse trie membership for case-folded siblings

2026-10-11 02:21:40 +08:00

ArtifactProvider.ts

fix(native): preserve universal Mach-O container identity

2026-10-12 09:29:07 +08:00

ArtifactProviderMetadata.ts

refactor(providers): use canonical artifact and managed identities

2026-10-10 00:49:14 +08:00

ArtifactReader.ts

fix(artifacts): bind directory reads to captured file state

2026-10-12 04:45:17 +08:00

ArtifactResourceScope.test.ts

fix(javascript): isolate source analysis and retain bounded partial evidence (#1651)

2026-10-11 07:22:50 +08:00

ArtifactResourceScope.ts

fix(workflows): retain staged output ownership and cancellation semantics

2026-10-12 06:29:27 +08:00

AsarArtifactReader.test.ts

fix: order remaining outputs independently of host locale (#1867)

2026-10-12 01:10:01 +08:00

AsarArtifactReader.ts

fix(artifacts): retain ASAR resources through cleanup failures

2026-10-12 05:05:21 +08:00

AsarEntryStream.ts

perf(artifacts): stream ASAR members without full buffering (#962)

2026-10-07 23:57:05 +08:00

AsarHeader.ts

fix(artifacts): retain ASAR resources through cleanup failures

2026-10-12 05:05:21 +08:00

DirectoryArtifactReader.ts

fix(artifacts): bind directory reads to captured file state

2026-10-12 04:45:17 +08:00

hostExecutableMarking.test.ts

fix(artifacts): mark Windows launchable files as host executables (#1824)

2026-10-12 01:15:35 +08:00

hostExecutableMarking.ts

fix(artifacts): bind directory reads to captured file state

2026-10-12 04:45:17 +08:00

MachOSliceArtifactReader.test.ts

fix(native): retain failed command cleanup owners

2026-10-11 13:39:42 +08:00

MachOSliceArtifactReader.ts

fix(native): accept universal binaries with LIB64 x86_64 slices (#1982)

2026-10-12 08:41:40 +08:00

NativeDmgArtifactReader.ts

fix(apple): preserve slice identity and macOS boundary diagnostics (#1772)

2026-10-13 06:06:37 +09:00

NativeDmgOwnership.ts

fix(artifacts): retain DMG ownership through uncertain attachment

2026-10-10 00:35:17 +08:00

OwnedFileHandle.test.ts

fix(artifacts)!: preserve descriptor cleanup authority

2026-10-11 05:17:10 +08:00

readStableArtifact.ts

feat(sqlite): inspect offline snapshots with selective evidence (#2271)

2026-10-12 18:33:23 +00:00

RegularFileAdmission.test.ts

feat(flutter): identify Dart snapshot builds and inspect AOT payloads by pure APK parsing (#1582)

2026-10-12 22:35:55 +08:00

SafeOutputTree.ts

fix(artifacts): reject Windows stream paths before extraction

2026-10-11 07:10:45 +08:00

SafeOutputTreeCleanup.ts

fix(artifacts): retain output identity through cleanup retries

2026-10-11 03:19:29 +08:00

SafeOutputTreeCreationFailure.ts

fix(artifacts): retain output ownership through publication failures

2026-10-11 05:17:10 +08:00

SafeOutputTreeIdentity.ts

fix(artifacts): retain output ownership through publication failures

2026-10-11 05:17:10 +08:00

SafeOutputTreeReadback.ts

fix(artifacts): retain output ownership through publication failures

2026-10-11 05:17:10 +08:00

StreamBytes.ts

Add evidence-backed investigation workflows

2026-07-12 21:12:18 +00:00

ZipArtifactReader.test.ts

fix(artifacts): bound archive decompression by source size (#2144)

2026-10-13 06:15:34 +09:00

ZipArtifactReader.ts

fix(artifacts): bound archive decompression by source size (#2144)

2026-10-13 06:15:34 +09:00