fix: reject oversized and invalid zip uploads (#25877) (#26179) · coder/coder@430ba84

"bytes"

"errors"

"io"

"log"

"math"

"strings"

"golang.org/x/xerrors"

)

// Ref:

// https://github.com/golang/go/blob/go1.24.0/src/archive/tar/format.go

// https://github.com/golang/go/blob/go1.24.0/src/archive/tar/writer.go

const (

tarBlockSize = 512

tarEndBlockBytes = 2 * tarBlockSize

)

// ErrArchiveTooLarge reports that archive expansion would exceed the

// configured limit.

var ErrArchiveTooLarge = xerrors.New("archive exceeds maximum size")

// ErrInvalidZipContent reports that a ZIP entry is malformed or its

// contents fail validation during conversion.

var ErrInvalidZipContent = xerrors.New("invalid zip content")

// CreateTarFromZip converts the given zipReader to a tar archive.

// maxSize limits the total tar output, including tar metadata.

func CreateTarFromZip(zipReader *zip.Reader, maxSize int64) ([]byte, error) {

err := validateZipArchiveSize(zipReader, maxSize)

if err != nil {

return nil, err

}

var tarBuffer bytes.Buffer

err := writeTarArchive(&tarBuffer, zipReader, maxSize)

err = writeTarArchive(&tarBuffer, zipReader, maxSize)

if err != nil {

return nil, err

}

return tarBuffer.Bytes(), nil

}

func writeTarArchive(w io.Writer, zipReader *zip.Reader, maxSize int64) error {

tarWriter := tar.NewWriter(w)

defer tarWriter.Close()

// validateZipArchiveSize performs a metadata-based preflight size

// check before conversion. The actual tar output limit will still be

// enforced while streaming.

func validateZipArchiveSize(zipReader *zip.Reader, maxSize int64) error {

if maxSize < 0 {

return ErrArchiveTooLarge

}

maxBytes := uint64(maxSize)

totalBytes := uint64(tarEndBlockBytes)

if totalBytes > maxBytes {

return ErrArchiveTooLarge

}

for _, file := range zipReader.File {

err := processFileInZipArchive(file, tarWriter, maxSize)

entrySize, err := projectedTarEntrySize(file)

if err != nil {

return err

}

if entrySize > maxBytes-totalBytes {

return ErrArchiveTooLarge

}

totalBytes += entrySize

}

return nil

}

func processFileInZipArchive(file *zip.File, tarWriter *tar.Writer, maxSize int64) error {

func projectedTarEntrySize(file *zip.File) (uint64, error) {

// Each tar entry contributes one header block plus its data

// rounded up to the next tar block boundary.

size := file.UncompressedSize64

if remainder := size % tarBlockSize; remainder != 0 {

padding := tarBlockSize - remainder

if size > math.MaxUint64-padding {

return 0, ErrArchiveTooLarge

}

size += padding

}

if size > math.MaxUint64-tarBlockSize {

return 0, ErrArchiveTooLarge

}

return tarBlockSize + size, nil

}

type limitedWriter struct {

w io.Writer

remaining int64

}

func (w *limitedWriter) Write(p []byte) (int, error) {

if len(p) == 0 {

return 0, nil

}

if w.remaining <= 0 {

return 0, ErrArchiveTooLarge

}

origLen := len(p)

if int64(origLen) > w.remaining {

p = p[:int(w.remaining)]

}

n, err := w.w.Write(p)

// io.Writer may report both written bytes and an error, so

// account for any accepted bytes before returning the error.

w.remaining -= int64(n)

if err != nil {

return n, err

}

if n < origLen {

return n, ErrArchiveTooLarge

}

return n, nil

}

func writeTarArchive(w io.Writer, zipReader *zip.Reader, maxSize int64) error {

tarWriter := tar.NewWriter(&limitedWriter{

w: w,

remaining: maxSize,

})

for _, file := range zipReader.File {

err := processFileInZipArchive(file, tarWriter)

if err != nil {

return err

}

}

return tarWriter.Close()

}

func processFileInZipArchive(file *zip.File, tarWriter *tar.Writer) error {

fileReader, err := file.Open()

if err != nil {

return err

}

defer fileReader.Close()

size := file.FileInfo().Size()

if size < 0 {

return ErrArchiveTooLarge

}

err = tarWriter.WriteHeader(&tar.Header{

Name: file.Name,

Size: file.FileInfo().Size(),

Size: size,

Mode: int64(file.Mode()),

ModTime: file.Modified,

// Note: Zip archives do not store ownership information.

return err

}

n, err := io.CopyN(tarWriter, fileReader, maxSize)

log.Println(file.Name, n, err)

if errors.Is(err, io.EOF) {

err = nil

_, err = io.CopyN(tarWriter, fileReader, size)

switch {

case errors.Is(err, io.EOF), errors.Is(err, io.ErrUnexpectedEOF):

return ErrInvalidZipContent

case errors.Is(err, zip.ErrChecksum), errors.Is(err, zip.ErrFormat):

return ErrInvalidZipContent

case err != nil:

return err

default:

return nil

}

return err

}

// CreateZipFromTar converts the given tarReader to a zip archive.