⭐
Log in to mark this repository.
Deps: zip 9
da96917 · Gabriel Morell · 2026-10-23 05:34
Message
{commit_body(@commit)}
Files changed
modified
Cargo.lock
+17
−4
@@ -2388,9 +2388,9 @@ checksum = "7a79a3332a6609480d7d0c9eab957bca6b455b91bb84e66d19f5ff66294b85b8"
| 2388 | 2388 | |
| 2389 | 2389 | [[package]] |
| 2390 | 2390 | name = "libc" |
| 2391 | −version = "0.2.176" | |
| 2391 | +version = "0.2.191" | |
| 2392 | 2392 | source = "registry+https://github.com/rust-lang/crates.io-index" |
| 2393 | −checksum = "58f929b4d672ea937a23a1ab494143d968337a5f47e56d0815df1e0890ddf174" | |
| 2393 | +checksum = "65cd87c9a6d60536580b316ad985726104730a5151c99845f2490428ef91240a" | |
| 2394 | 2394 | |
| 2395 | 2395 | [[package]] |
| 2396 | 2396 | name = "libfuzzer-sys" |
@@ -2723,6 +2723,18 @@ version = "1.0.6"
| 2723 | 2723 | source = "registry+https://github.com/rust-lang/crates.io-index" |
| 2724 | 2724 | checksum = "650eef8c711430f1a879fdd01d4745a7deea475becfb90269c06775983bbf086" |
| 2725 | 2725 | |
| 2726 | +[[package]] | |
| 2727 | +name = "nix" | |
| 2728 | +version = "0.31.3" | |
| 2729 | +source = "registry+https://github.com/rust-lang/crates.io-index" | |
| 2730 | +checksum = "cf20d2fde8ff38632c426f1165ed7436270b44f199fc55284c38276f9db47c3d" | |
| 2731 | +dependencies = [ | |
| 2732 | + "bitflags 2.9.4", | |
| 2733 | + "cfg-if", | |
| 2734 | + "cfg_aliases", | |
| 2735 | + "libc", | |
| 2736 | +] | |
| 2737 | + | |
| 2726 | 2738 | [[package]] |
| 2727 | 2739 | name = "no_std_io2" |
| 2728 | 2740 | version = "0.9.4" |
@@ -5964,14 +5976,15 @@ dependencies = [
| 5964 | 5976 | |
| 5965 | 5977 | [[package]] |
| 5966 | 5978 | name = "zip" |
| 5967 | −version = "8.6.0" | |
| 5979 | +version = "9.0.5" | |
| 5968 | 5980 | source = "registry+https://github.com/rust-lang/crates.io-index" |
| 5969 | −checksum = "2d04a6b5381502aa6087c94c669499eb1602eb9c5e8198e534de571f7154809b" | |
| 5981 | +checksum = "6e04976da629d3b04204ba8105b396a193af8ad2583b2c79bfb3ab8af580a11e" | |
| 5970 | 5982 | dependencies = [ |
| 5971 | 5983 | "crc32fast", |
| 5972 | 5984 | "flate2", |
| 5973 | 5985 | "indexmap", |
| 5974 | 5986 | "memchr", |
| 5987 | + "nix", | |
| 5975 | 5988 | "typed-path", |
| 5976 | 5989 | "zopfli", |
| 5977 | 5990 | ] |
modified
Cargo.toml
+1
−1
@@ -64,7 +64,7 @@ qrcode = { version = "0.14", default-features = false, features = ["svg"] }
| 64 | 64 | reqwest = { version = "0.12", default-features = false, features = ["json", "multipart", "rustls-tls"] } |
| 65 | 65 | # Zip ingest. Only the codecs real-world image archives use — "stored" is |
| 66 | 66 | # always available, deflate covers everything Finder/Explorer produce. |
| 67 | −zip = { version = "8", default-features = false, features = ["deflate"] } | |
| 67 | +zip = { version = "9", default-features = false, features = ["deflate"] } | |
| 68 | 68 | |
| 69 | 69 | [build-dependencies] |
| 70 | 70 | minijinja-embed = "2.12" |
modified
src/handlers/uploads.rs
+18
−0
@@ -1471,6 +1471,24 @@ mod zip_unit_tests {
| 1471 | 1471 | assert_eq!(scan.skipped_unsupported, 1, "only the json is unsupported"); |
| 1472 | 1472 | } |
| 1473 | 1473 | |
| 1474 | + /// Names that climb out of the archive are refused by enclosed_name() and | |
| 1475 | + /// tallied as skips, never taken. A leading `/` is only made relative, so | |
| 1476 | + /// that entry stays inside and is taken by its basename. | |
| 1477 | + #[test] | |
| 1478 | + fn escaping_names_are_skipped() { | |
| 1479 | + let zip = make_zip(&[ | |
| 1480 | + ("../escape.png", b"up one"), | |
| 1481 | + ("sub/../../escape.jpg", b"up two"), | |
| 1482 | + ("/abs.png", b"rooted"), | |
| 1483 | + ("ok.png", b"fine"), | |
| 1484 | + ]); | |
| 1485 | + let (got, scan) = scan(zip, 1024, 1024 * 1024, 100); | |
| 1486 | + | |
| 1487 | + let names: Vec<&str> = got.iter().map(|e| e.name.as_str()).collect(); | |
| 1488 | + assert_eq!(names, vec!["abs.png", "ok.png"]); | |
| 1489 | + assert_eq!(scan.skipped_unsupported, 2); | |
| 1490 | + } | |
| 1491 | + | |
| 1474 | 1492 | #[test] |
| 1475 | 1493 | fn oversize_entries_are_skipped_not_fatal() { |
| 1476 | 1494 | let zip = make_zip(&[("small.png", b"tiny"), ("big.png", &[0u8; 512])]); |
Parents: c9c6f38