From 8835cdea7c3b49c5367135b262b14c261683755c Mon Sep 17 00:00:00 2001 From: link2xt Date: Thu, 3 Sep 2026 10:12:24 +0000 Subject: [PATCH] feat: refuse to load blobs larger than 100 MB from webxdc archives --- src/webxdc.rs | 5 ++++- src/webxdc/webxdc_tests.rs | 16 ++++++++++++++++ test-data/webxdc/1g-index-file.xdc | Bin 0 -> 970926 bytes 3 files changed, 20 insertions(+), 1 deletion(-) create mode 100644 test-data/webxdc/1g-index-file.xdc diff --git a/src/webxdc.rs b/src/webxdc.rs index 9ca1e0f278..98876e2bd0 100644 --- a/src/webxdc.rs +++ b/src/webxdc.rs @@ -847,8 +847,11 @@ fn parse_webxdc_manifest(bytes: &[u8]) -> Result { } async fn get_blob(archive: &mut SeekZipFileReader>, name: &str) -> Result> { - let (i, _) = + let (i, zip_entry) = find_zip_entry(archive.file(), name).ok_or_else(|| anyhow!("no entry found for {name}"))?; + if zip_entry.uncompressed_size() > 100_000_000 { + bail!("Webxdc file {name} is too large"); + } let mut reader = archive.reader_with_entry(i).await?; let mut buf = Vec::new(); reader.read_to_end_checked(&mut buf).await?; diff --git a/src/webxdc/webxdc_tests.rs b/src/webxdc/webxdc_tests.rs index 9a3fb43264..13bc03ee68 100644 --- a/src/webxdc/webxdc_tests.rs +++ b/src/webxdc/webxdc_tests.rs @@ -1145,6 +1145,22 @@ async fn test_get_webxdc_blob_with_subdirs() -> Result<()> { Ok(()) } +#[tokio::test(flavor = "multi_thread", worker_threads = 2)] +async fn test_1g_index_blob() -> Result<()> { + let t = TestContext::new_alice().await; + let chat_id = create_group(&t, "foo").await?; + let mut instance = create_webxdc_instance( + &t, + "1gb-index-file.xdc", + include_bytes!("../../test-data/webxdc/1g-index-file.xdc"), + )?; + chat_id.set_draft(&t, Some(&mut instance)).await?; + + assert!(instance.get_webxdc_blob(&t, "index.html").await.is_err()); + + Ok(()) +} + #[tokio::test(flavor = "multi_thread", worker_threads = 2)] async fn test_parse_webxdc_manifest() -> Result<()> { let result = parse_webxdc_manifest(r#"key = syntax error"#.as_bytes()); diff --git a/test-data/webxdc/1g-index-file.xdc b/test-data/webxdc/1g-index-file.xdc new file mode 100644 index 0000000000000000000000000000000000000000..452b6706a270b588ec77606050d55b035d1c0cbe GIT binary patch literal 970926 zcmeI*OUNr{0mtE)GozeV%>^4c8j+wC?4}eEjnrVW34)*z=PbmQG`4cIcFw7`NY||tEv1@(B0&+a6b%}0(eb>q5JfkxQ*88tsxm?_kWOsbynZ>I< z{P4XWc<6aan*TgYlIHDK&;QK>Kl|xte*Dh6?mGPbclY0L;pq#5?{1%e^X2k^&sI0R zqk7B7-n(4Z*RLn<`_XUPuYB20e(~c=-+tfdPmkAs`ouRsw0Zg?_kI3zm+sxa?+@co zz4*1?`QV!$e)dbZJaVP_<)zo(`PVzX|GHPaI!$K(c*wV3d-P;h0t5&UAV7cs0RsOUf&CBC|ILlvl>h+(1PBly zK!5-N0t5&UAV7csf&VjskB^3(Ch52=^UE#*1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZAa;S?=`e1#0NZ-gEn=_n`~(OPAV7cs0RjXF5FkK+009C72oNAZfB*pk z1PBlyK!CvI{VHpIhjdWyrZXM{2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ zK=cBOb}J7*3{ait{YmsS0tgTwK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB=E@ zXxM4~Nx*Sg<~RrtAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5;&=mmPG!?@W3 zZ0k+8h(1RE0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAh2I$X&3_x>fLmP zg8%^n1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oQ)~V9{>nVGB^5=lx0aH3A3_ zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5;&^=Q}$TY%)aEOQ(L2oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+K=cB=(_!3f0k-v~TST8DfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oTt>vNVhV2K8<_!$E)m0RjXF5FkK+009C72oNAZ zfB*pk1PBlyK!5-N0t5&|FR*C0@~{P{&h!2x`WgWQ2oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+zE2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5Fik}K<{)IH(P*hz3CRw z=LjG`fB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C7_Ny!nV}L=uo6c|$AV7cs z0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0?`XB+O0fn0jl%7KZ(9Z009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FoG~4Le~AkQ|p~j)MRJ0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PBm_UZ8h6jGHaMw%&A$=yL=RAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5-N0{c~#hB3gP-c4sX2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RjXF5FkK+0D0*iJl4_koh zJnv7UuMt3i009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXFtVhF6*a9TSWtrn3 zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1fmz{oetw>3$U#>-6HxN0R#vT zAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!Cu0m8D?}FsOIa84dyj2oNAZfB*pk z1PBlyK!5-N0t5&UAV7cs0RjXF5FkJxdVxi|m4_`rb)NSp(botdK!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk1lFTrCu{+dn-O9rjpgPa{ljv&%5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs z0RrpMuoJcb$#GfcI0z6RK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB=E$1$w8$ zxY+`1>rJG>icT^=>-DL4W`O0t5&UAV7cs0RjXF z5FkK+009C72oNAZfB*pk1PDYguxPjPumz~j^Zq3I8UX|d5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV7e?dNk~WEkJTymN^ar1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+ z009C72oNAZAbNq`=`e1#0NZ-gEuzm6K!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PJU`SsKOwgL*fe;UGYO009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjY~ z7g)4gdDsF}=Xrk;eT@JD1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZU_Bak z!WJMoF3TJT0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAP~Jk?{pY9TYzo7 z=@!xF2p~X!009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjZ}t1Jy;fI+>R&TtSQ zK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk(F-ivtvqZ2s`I=*iM~bv0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAg~?{J7Eiu9G7K|g8%^n1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72oQ)~pm#cqn=Qb$-gJxTa|93|K!5-N0t5&UAV7cs z0RjXF5FkK+009C72oNAZfB*pk`&E{PF~FeSO=ma=5FkK+009C72oNAZfB*pk1PBly zK!5-N0t5&UAV7csf#?Mm?N%PP0M&WkpG03HfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72oPA0hMlklNRG=g$3cJq0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0t5&|FVH(3#?2OBTW`8W^f>|u5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs zf&D5=!x&&t@1`>x1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfI##Di*_py zTY&03?@ywy5kP0=?5=+-w21^`=`ypCf<(0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U*sroQi~$DqZaTw3fB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5FkK+009C72t+TiXt(mP1*p#R{v`Su0R#vTAV7cs0RjXF5FkK+ z009C72oNAZfB*pk1PBlyK!Ct{H0*>eKyqA`ISv8@2oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5FkJxdV${QFmAR0+j`S2qR$aPfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF z5FkK+009C72<%r`8pZ&FdN-ZnAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N z0tBKLShQPt*aB4Nd4CdpjQ|1!2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkKc zJsNhx79cq;%Nz#*0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly5WPU}bQm{V zfNj0$7SZPjAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyK!5-N0tEJ}EDd9TLA{&K za1bCsfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009Eg3oP2LJZu4~^SnQazD586 z0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PBlyupSLNVGEEPmt~HF009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5Qtu&cRGxlEx@+kbc^V71P~xVfB*pk1PBly zK!5-N0t5&UAV7cs0RjXF5FkK+009E~RhEV^z@XkuXE+EDAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk1PBlyK!5;&=mi$-Rvxwh)p_2ZL|-F-009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF5Ll0fov;N+j>|H~L4W`O0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1PDYg&^sN*%@$x=Z@NYFIRXd}AV7cs0RjXF5FkK+009C72oNAZfB*pk1PBly zK!5;&{VGet7+_HErZXG_2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+K=cBO zb}J8Cfa*N&Pol38K!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1PH80!%o-& zB*$f$;~+qQ009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjY~7wDZ1<7Nx6tvB5w z`WyiS2oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+zE2oNAZfB*pk1PBlyK!5-N0t5&U zAV7cs0RjXF5Fik}z@pvC!xo@A&-;_;YXlG=K!5-N0t5&UAV7cs0RjXF5FkK+009C7 z2oNAZfB*pk>(Q_iwgAa-S>`wh5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs zf#?N#r^C3}0&MF|w}?JR009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RjXF5FoH$ zWoZ}#4C>uSML009C72oNAZ zfB*pk1PBlyK!5-N0t5&UAV7cs0RjXFL@%&txAL$BsLu2LB>EZw1PBlyK!5-N0t5&U zAV7cs0RjXF5FkK+009C72oNAZfWUe*?1U{qa$J@<4gv%S5FkK+009C72oNAZfB*pk z1PBlyK!5-N0t5&UAV45`f!^sbZngm1debeU&k;a?009C72oNAZfB*pk1PBlyK!5-N z0t5&UAV7cs0RjXF>{nSD#sGtQH=W@iK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZ zfB*pk1fmyMv|D-D0#xUDe-eF-00IOE5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&U zAV6R}8g{}KAUQ6}90vgc1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oN9;y+H4D z7&lvhZN2Fh(dP&tK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNAZfB*pk1oo>e4P$^o zy_?Q(5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&UAV7cs0RqtrEZVI+YyqnCyg!M) zMgRc<1PBlyK!5-N0t5&UAV7cs0RjXF5FkK+009C72oNB!9t}HT3y>U_WsZXY0RjXF z5FkK+009C72oNAZfB*pk1PBlyK!5-N0t5&Uh+g2cr^Bbi6kz;Rz5Bv#7s6K;0RjXF z5FkK+z<(p~!wa)Fr59eB-IQENE+$`n?B?Rp7e4;RyRRQ{<@)Pla_Jw3J^In`^*wiA zyL#*WSFcyyrYO-1oxuzb{<>{Bt-f`8#ldgwp^3 literal 0 HcmV?d00001