Bound restore archives and validate attachment integrity

[mjc]

Summary

Harden restore against malformed or untrusted dump archives while preserving normal dump/restore behavior.

• Stream manifest, database, and attachment entries through explicit size, entry-count, total-expansion, and decompression limits.
• Reject duplicate control entries, unsafe archive paths, unsupported tar entry types, and manifest/member size or count mismatches before installation.
• Validate the staged database before it can replace live state: SQLite integrity, schema compatibility, attachment hash/MIME/size metadata, blob existence, content hashes, and detected content types.
• Enforce canonical attachment hashes and allowed metadata at both the SQLite schema and storage boundaries.
• Stage database and attachment swaps together, serialize concurrent restores, preserve pre-restore state, and roll back ordinary installation failures.
• Continue accepting older attachment archives whose pending migrations can be applied on the next start.

The branch-added tests cover compressed expansion bombs, oversized entries, excessive entry counts, duplicate control entries, traversal attempts, legacy schema compatibility, invalid attachment metadata, blob hash and MIME mismatches, missing blobs, symlink-safe staging, concurrent restore locking, rollback behavior, and successful dump/restore round trips.

[Copilot]

Pull request overview

This PR hardens dump/restore and attachment handling so restores from malformed or untrusted archives are bounded, traversal-safe, and integrity-checked before they can replace live state. It also tightens attachment metadata invariants across both the Rust storage layer and the SQLite schema.

Changes:

• Enforce canonical lowercase SHA-256 attachment addresses at storage, restore, and DB schema boundaries.
• Add restore-time limits and validations (entry types, counts, sizes, decompression bounds) plus staged SQLite + attachment integrity checks before installation.
• Introduce migration 043_attachment_integrity and update tests to use real content-addressed hashes.

Reviewed changes

Copilot reviewed 9 out of 9 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/storage.rs	Adds valid_sha256 and enforces hash validation before building attachment/thumb paths (plus traversal test).
src/mcp/tools.rs	Updates MCP-related tests to use real SHA-256 hashes for attachments.
src/dump.rs	Implements bounded archive inspection/extraction, staged DB+blob integrity validation, restore locking, and rollback/transactional installation.
src/db/queries/users.rs	Adjusts test SQL to insert a valid attachment SHA.
src/db/queries/search.rs	Updates tests to seed attachments with valid SHA-256 hashes.
src/db/queries/comments.rs	Updates attachment test to use a valid SHA-256 hash.
src/db/queries/attachments.rs	Refactors tests to consistently generate valid hashes; adds test asserting invalid hash/mime rejection.
src/db/migrate.rs	Registers migration 43 and marks it as FK-rebuild-sensitive.
migrations/043_attachment_integrity.sql	Rebuilds attachments with CHECK constraints for sha256/mime/size and restores FTS triggers.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.