paulmataruso/zulip
1
0
Fork 0
mirror of https://github.com/zulip/zulip.git synced 2025-11-02 21:13:36 +00:00
Code Issues Packages Projects Releases Wiki Activity

slack: Protect against zip bombs.

Browse Source 
A file which unpacks to more than 10x its original size is suspect,
particularly if that results in an uncompressed size > 1GB.
This commit is contained in:
Alex Vandiver
2024-09-20 18:06:01 +00:00
committed by Tim Abbott
parent 6f7c14c9ec
commit e68096c907
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
zerver/data_import/slack.py
View File

@@ -1378,6 +1378,7 @@ def do_convert_zipfile(
os.makedirs(slack_data_dir, exist_ok=True) os.makedirs(slack_data_dir, exist_ok=True)
with zipfile.ZipFile(original_path) as zipObj: with zipfile.ZipFile(original_path) as zipObj:
total_size = 0
for fileinfo in zipObj.infolist(): for fileinfo in zipObj.infolist():
# Slack's export doesn't set the UTF-8 flag on each # Slack's export doesn't set the UTF-8 flag on each
# filename entry, despite encoding them as such, so # filename entry, despite encoding them as such, so
@@ -1398,6 +1399,15 @@ def do_convert_zipfile(
if not re.match(r"[^/]+(\.json|/([^/]+\.json)?)$", fileinfo.filename): if not re.match(r"[^/]+(\.json|/([^/]+\.json)?)$", fileinfo.filename):
raise Exception("This zip file does not look like a Slack archive") raise Exception("This zip file does not look like a Slack archive")
# file_size is the uncompressed size of the file
total_size += fileinfo.file_size
# Based on historical Slack exports, anything that is more
# than a 10x size magnification is suspect, particularly
# if it results in over 1GB.
if total_size > 1024 * 1024 * 1024 and total_size > 10 * os.path.getsize(original_path):
raise Exception("This zip file is possibly malicious")
zipObj.extractall(slack_data_dir) zipObj.extractall(slack_data_dir)
do_convert_directory(slack_data_dir, output_dir, token, threads, convert_slack_threads) do_convert_directory(slack_data_dir, output_dir, token, threads, convert_slack_threads)