Library archive extraction: bound per-entry size #449

Activity

1. andersalm

   added this to the After 0.8.0 milestone on Oct 18, 2026
2. andersalm commented on Oct 19, 2026

   

   andersalm

   on Oct 19, 2026

   ContributorAuthor

   More actions

   Widened by #444 review, M3 (Medium; existed at base):

   • The problem: the start walk refuses depth ≥ 16 (auth.rs:7381-7383), but no writer limits depth (library.rs:3272-3307, :5477-5492), and zip extraction has no entry-count limit (:5433-5475). A peer zip with 17 nested folders, or an app writing a 17-deep path, stops the next start with an N1 refusal.
   • Fix: enforce the walk rules when writing and extracting (depth, names, entry count), or turn the depth limit into a notice that skips the subtree.
   • Timing: the reviewer recommends this before 0.8.0 stable; Anders decides.

   Source: #444 security review (security-reviewer, reviewed 453f56eb2 and fix delta de2cf6276; local report /tmp/sec444.md) and Codex review /tmp/codex-runs/c444fix.final.md. Line refs at de2cf6276 on fix/444-check-at-open.
3. andersalm commented on Oct 19, 2026

   

   andersalm

   on Oct 19, 2026

   Last edited by andersalm

   ContributorAuthor

   More actions

   Source review PASS at d042c740bde4c252d8f8b14231beedc4ec48aed3 closes the global PAX inspection-budget blocker. The review is limited to the delta from ab1f76ebc; its added controls preserve small global PAX input support.
   The two completed current-head attempts have passing subsets and missing remote exit status, with no completed gate verdict. OMP has integrated the archive correction locally; combined checks and installed extraction acceptance remain open.
   The inherited nested-folder and selected Skip/Keep Both write races keep the After 0.8 disposition in #449 (comment). This review does not close the full issue.
4. andersalm commented on Oct 19, 2026

   

   andersalm

   on Oct 19, 2026

   ContributorAuthor

   More actions

   After 0.8.0 (found by Codex in batchsasha5; these were already in the base and the batch didn't introduce them):

   • Whole extraction, nested folders: the extraction root is now created exclusively. Nested folders still use create_dir_all, and files go through the replacing writer (library.rs:5720). Another request that saves destination/sub/file during extraction can have that file replaced.
   • Selected extraction: the Skip/KeepBoth conflict check (library.rs:5452) and the replacing write (:5426) are separate steps. A file created by another request between the two can be overwritten. An explicit Replace is intended.
   • Fix direction: an exclusive create for each new file; on a collision, re-run the conflict choice instead of replacing.

   0.8.0 batch status: round 5 closed the exclusive destination and PAX sparse refusal. One P2 remains: bytes a global PAX header consumes during inspection were credited back to the header allowance. That fix is in progress.