fix(ergasia): validate archive entries and enforce extraction byte caps - #555
Merged
Conversation
Harden archive extraction against arbitrary file write and decompression bombs on attacker-controlled torrent/usenet payloads. - RAR path traversal: extract_rar now validates every entry across the whole volume set before any write, rejecting absolute paths, parent traversal, and symlink/non-regular entries (unix mode in file_attr, since unrar 0.5.8 does not surface the RAR5 FSREDIR redirect kind). - 7z path traversal: extract_7z replaces decompress_file with the custom decompress_file_with_extract_fn, pre-scanning + per-entry validating names and rejecting symlink/reparse/non-regular entries. - RAR bomb denominator: volume_set_size derives the compressed size from this archive's actual naming chain, signature-verifying each volume so junk-extension padding cannot inflate the ratio denominator. - Nested-archive symlink follow: find_nested_archives uses non-following DirEntry::file_type() instead of Path::is_file/is_dir. - Header-trust bomb: real extraction output is capped at declared×ratio (streaming Take for 7z, post-hoc rollback for RAR whose writes unrar controls internally). Gate-Passed: kanon 0.1.5 +stages:fmt,check,clippy,nextest,lint sha:f04b04e6ff392177efc91a320ae30da2e0ccdfd1
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Hardens archive extraction against attacker-controlled torrent/usenet payloads (found by the deep-audit). The ZIP backend already validated entries; RAR and 7z did not.
extract_rarnow pre-validates every header across the volume set (absolute paths,.., non-UTF-8, and symlink/non-regular entries viast_mode), rejecting the whole archive before any write.decompress_filewith the custom extract-fn API + pre-scan + per-entry re-validation; rejects symlinks (reparse-point / unix-mode).find_nested_archivesuses non-followingfile_type()..take()+ rollback; RAR post-hoc snapshot-diff + rollback) aborts when output exceedsdeclared × ratio, no longer trusting self-reported header sizes.9 new security tests; gate
kanon gate --fullgreen (1839 tests).Closes #516
Closes #517
Closes #523
Closes #535
Closes #537