Currently deserializeInner() decompresses without bounds, making it vulnerable to zip bomb attacks (a small compressed payload that expands to gigabytes).
Add io.LimitReader wrapping the zstd decompressor, using m.pbOuter.Size (or a reasonable max like 256MB) as the bound. Return an error if the decompressed data exceeds the limit.
**Phase 1 item from #10**
Currently `deserializeInner()` decompresses without bounds, making it vulnerable to zip bomb attacks (a small compressed payload that expands to gigabytes).
Add `io.LimitReader` wrapping the zstd decompressor, using `m.pbOuter.Size` (or a reasonable max like 256MB) as the bound. Return an error if the decompressed data exceeds the limit.
clawbot
self-assigned this 2026-02-09 01:05:41 +01:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
Phase 1 item from #10
Currently
deserializeInner()decompresses without bounds, making it vulnerable to zip bomb attacks (a small compressed payload that expands to gigabytes).Add
io.LimitReaderwrapping the zstd decompressor, usingm.pbOuter.Size(or a reasonable max like 256MB) as the bound. Return an error if the decompressed data exceeds the limit.