Found during a security audit (session that produced PR #44).
Where: lib/sloppak.py, _unpack_zip
Issue: No decompressed-size cap when extracting a .sloppak zip. A highly-compressed malicious pack could exhaust disk space on import.
Impact: Self-inflicted in the single-user model (a user importing their own malicious file), but worth capping for defense-in-depth — same class of issue fixed in feedBack-plugin-feedpakr's _read_zip_member_capped and feedpak-spec's validator.
Suggested fix: Cap total decompressed size (sum of info.file_size across members, or a streaming per-member cap) before/during extraction, mirroring the pattern used elsewhere in this ecosystem.
Found during a security audit (session that produced PR #44).
Where:
lib/sloppak.py,_unpack_zipIssue: No decompressed-size cap when extracting a
.sloppakzip. A highly-compressed malicious pack could exhaust disk space on import.Impact: Self-inflicted in the single-user model (a user importing their own malicious file), but worth capping for defense-in-depth — same class of issue fixed in
feedBack-plugin-feedpakr's_read_zip_member_cappedandfeedpak-spec's validator.Suggested fix: Cap total decompressed size (sum of
info.file_sizeacross members, or a streaming per-member cap) before/during extraction, mirroring the pattern used elsewhere in this ecosystem.