Mitigate Zip Bombs

[ildyria]

This does not warrant a CVE. At best it would be a 2.3

Summary by CodeRabbit

• New Features
  • Added stronger ZIP upload protection against zip-bombs (size, entries, compression ratio) and unsafe paths.
  • Added new configuration limits and an option to delete rejected ZIP files.
  • Added support for human-readable file sizes (for limits, upload chunk size, and default user quota).
• Bug Fixes
  • Prevented partially extracted files from being left behind when ZIP uploads are rejected.
• Documentation
  • Added/updated translated settings help text across supported languages, including the new ZIP-bomb and unit-based size options.
• Tests
  • Added coverage for ZIP-bomb rejection behavior and size parsing.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 10ec19fe-2ede-4a1b-acf8-829618d3c3ff

📥 Commits

Reviewing files that changed from the base of the PR and between 0be4796 and 83095bf.

📒 Files selected for processing (3)

• app/Actions/User/Create.php
• app/Actions/User/Save.php
• app/Jobs/ExtractZip.php

🚧 Files skipped from review as they are similar to previous changes (2)

• app/Actions/User/Save.php
• app/Jobs/ExtractZip.php

---

📝 Walkthrough

Walkthrough

Human-readable size configuration and ZIP-bomb protection are added. ZIP extraction now validates archive limits, prevents traversal, streams real bytes, handles rejected files, and records failures. Configuration migrations, localized settings text, and unit/integration tests support the new behavior.

Changes

ZIP security and size configuration

Layer / File(s)	Summary
File-size configuration contracts and accessors app/Assets/Helpers.php, app/Enum/ConfigType.php, app/Models/Configs.php, app/Repositories/ConfigManager.php, app/Actions/User/*, app/Http/Resources/GalleryConfigs/UploadConfig.php	Human-readable sizes are parsed, validated, converted to bytes, and consumed by quota and upload settings.
Safe ZIP inspection and extraction app/Services/Zip/SafeZipExtractor.php, app/Exceptions/Internal/ZipBombDetectedException.php	ZIP archives are inspected against declared limits, extracted through bounded streams, and protected against unsafe paths and partial output.
ZIP job integration app/Jobs/ExtractZip.php	ZIP validation and extraction use the safe extractor, update job status on failures, map exceptions, and optionally delete rejected archives.
Configuration registration and migration database/migrations/*	ZIP-bomb settings are registered and existing size configuration values are converted to and from FILE_SIZE format.
Localized settings and validation coverage lang/*/all_settings.php, tests/*	Settings descriptions are localized, while conversion, validation, extraction, rejection, and cleanup behavior receive test coverage.

Estimated code review effort: 4 (Complex) | ~60 minutes

Poem

A rabbit packed limits in a ZIP so tight,
Checked every byte by moonlit night.
Safe paths hopped, bad bombs were caught,
Old sizes learned the units they sought.
“No sneaky archives!” the bunny cheered—
While tests danced round the files secured.

🚥 Pre-merge checks | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 42.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[ildyria]

@coderabbitai review please.

[coderabbitai]

@ildyria I’ll review the changes for correctness and zip-bomb mitigation coverage.

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[coderabbitai]

Actionable comments posted: 6

🧹 Nitpick comments (1)

tests/ImageProcessing/Photo/PhotoZipUploadTest.php (1)

144-147: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Use \ZipArchive::OVERWRITE to prevent stale test state.

Using \ZipArchive::CREATE without \ZipArchive::OVERWRITE appends to the archive if the file already exists. If a previous test run aborts before cleanup, subsequent tests may fail due to the file containing leftover entries.

• tests/ImageProcessing/Photo/PhotoZipUploadTest.php#L144-L147: combine the flags here: \ZipArchive::CREATE | \ZipArchive::OVERWRITE.
• tests/ImageProcessing/Photo/PhotoZipUploadTest.php#L160-L163: combine the flags here as well.
• tests/ImageProcessing/Photo/PhotoZipUploadTest.php#L175-L178: combine the flags here as well.
• tests/ImageProcessing/Photo/PhotoZipUploadTest.php#L202-L205: combine the flags here as well.
• tests/ImageProcessing/Photo/PhotoZipUploadTest.php#L223-L226: combine the flags here as well.

♻️ Proposed fix

-		if ($zip->open(TestConstants::SAMPLE_TEST_ZIP, \ZipArchive::CREATE) !== true) {
+		if ($zip->open(TestConstants::SAMPLE_TEST_ZIP, \ZipArchive::CREATE | \ZipArchive::OVERWRITE) !== true) {

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 2e1ba5c8-8e52-4eed-b613-66e7cb7e5aa9

📥 Commits

Reviewing files that changed from the base of the PR and between 0c44745 and 0be4796.

📒 Files selected for processing (42)

• app/Actions/User/Create.php
• app/Actions/User/Save.php
• app/Assets/Helpers.php
• app/Enum/ConfigType.php
• app/Exceptions/Internal/ZipBombDetectedException.php
• app/Facades/Helpers.php
• app/Http/Resources/GalleryConfigs/UploadConfig.php
• app/Jobs/ExtractZip.php
• app/Models/Configs.php
• app/Repositories/ConfigManager.php
• app/Services/Zip/SafeZipExtractor.php
• database/migrations/2026_07_18_000000_add_zip_bomb_protection_configs.php
• database/migrations/2026_07_18_010000_convert_existing_configs_to_file_size_format.php
• database/migrations/2026_07_18_020000_add_zip_bomb_delete_rejected_file_config.php
• lang/ar/all_settings.php
• lang/bg/all_settings.php
• lang/cz/all_settings.php
• lang/de/all_settings.php
• lang/el/all_settings.php
• lang/en/all_settings.php
• lang/es/all_settings.php
• lang/fa/all_settings.php
• lang/fr/all_settings.php
• lang/hu/all_settings.php
• lang/it/all_settings.php
• lang/ja/all_settings.php
• lang/nl/all_settings.php
• lang/no/all_settings.php
• lang/pl/all_settings.php
• lang/pt/all_settings.php
• lang/ru/all_settings.php
• lang/sk/all_settings.php
• lang/sv/all_settings.php
• lang/tr/all_settings.php
• lang/vi/all_settings.php
• lang/zh_CN/all_settings.php
• lang/zh_TW/all_settings.php
• tests/ImageProcessing/Photo/PhotoZipUploadTest.php
• tests/Unit/HelpersUnitTest.php
• tests/Unit/Models/ConfigsTest.php
• tests/Unit/Repositories/ConfigManagerTest.php
• tests/Unit/Services/Zip/SafeZipExtractorTest.php

[codecov]

Codecov Report

❌ Patch coverage is 73.68421% with 45 lines in your changes missing coverage. Please review.
✅ Project coverage is 90.23%. Comparing base (9c31578) to head (83095bf).
⚠️ Report is 2 commits behind head on master.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.