feat: refuse to load blobs larger than 100 MB from webxdc archives

src/webxdc.rs

@@ -847,8 +847,11 @@ fn parse_webxdc_manifest(bytes: &[u8]) -> Result<WebxdcManifest> {
 }
 
 async fn get_blob(archive: &mut SeekZipFileReader<BufReader<File>>, name: &str) -> Result<Vec<u8>> {
-    let (i, _) =
+    let (i, zip_entry) =
         find_zip_entry(archive.file(), name).ok_or_else(|| anyhow!("no entry found for {name}"))?;
+    if zip_entry.uncompressed_size() > 100_000_000 {
+        bail!("Webxdc file {name} is too large");
+    }
     let mut reader = archive.reader_with_entry(i).await?;
     let mut buf = Vec::new();
     reader.read_to_end_checked(&mut buf).await?;

src/webxdc/webxdc_tests.rs

@@ -1145,6 +1145,22 @@ async fn test_get_webxdc_blob_with_subdirs() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn test_1g_index_blob() -> Result<()> {
+    let t = TestContext::new_alice().await;
+    let chat_id = create_group(&t, "foo").await?;
+    let mut instance = create_webxdc_instance(
+        &t,
+        "1gb-index-file.xdc",
+        include_bytes!("../../test-data/webxdc/1g-index-file.xdc"),
+    )?;
+    chat_id.set_draft(&t, Some(&mut instance)).await?;
+
+    assert!(instance.get_webxdc_blob(&t, "index.html").await.is_err());
+
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn test_parse_webxdc_manifest() -> Result<()> {
     let result = parse_webxdc_manifest(r#"key = syntax error"#.as_bytes());