Skip to content

fix(security): add extraction size limit to prevent decompression bomb [DEVA11Y-484] - #22

Open
sunny-se wants to merge 1 commit into
mainfrom
fix/DEVA11Y-484-extraction-size-limit
Open

fix(security): add extraction size limit to prevent decompression bomb [DEVA11Y-484]#22
sunny-se wants to merge 1 commit into
mainfrom
fix/DEVA11Y-484-extraction-size-limit

Conversation

@sunny-se

@sunny-se sunny-se commented May 26, 2026 •
edited by atlassian Bot
Loading

Copy link
Copy Markdown
Collaborator

Summary

  • CWE-400 / CVSS 5.3 — bsdtar extraction in extractRemoteArchive() and extractLocalArchive() had no size or entry-count limit, enabling decompression bomb DoS via crafted archive (F-015).
  • Adds validateExtractedSize(of:maxBytes:) helper that enumerates extracted files, sums sizes, and throws + cleans up if total exceeds 100 MB.
  • Validation called after both remote and local extraction paths.

Test plan

  • Build Xcode plugin target — verify compilation
  • Extract a normal CLI archive — confirm it passes the 100 MB check
  • (Optional) Craft a >100 MB test archive — confirm extraction is rejected and directory is removed
  • Verify fallback path (non-archive executable copy) in extractLocalArchive still works

Jira: DEVA11Y-484

🤖 Generated with Claude Code
@sunny-se @claude
fix(security): add extraction size limit to prevent decompression bomb
05c39bf 
F-015 / DEVA11Y-484 — bsdtar extraction had no size or entry-count
limit (CWE-400), allowing decompression bomb DoS. Add a 100 MB post-
extraction size check that removes the output and errors on violation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
@sunny-se
sunny-se requested a review from a team as a code owner May 26, 2026 09:02
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

1 participant

@sunny-se