fix: bound gzip decompression in /import to prevent decompression bomb DoS#108
Open
hacktron-app-stg[bot] wants to merge 1 commit into
Open
fix: bound gzip decompression in /import to prevent decompression bomb DoS#108hacktron-app-stg[bot] wants to merge 1 commit into
hacktron-app-stg[bot] wants to merge 1 commit into
Conversation
Wrap the gzip reader with io.LimitReader (10 MiB cap) so a small decompression-bomb payload can no longer expand unbounded into memory and OOM-crash the process. Oversized payloads now return HTTP 413 and read errors return HTTP 400.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Vulnerability
The
/importendpoint (importHandlerinauth_gateway.go) decompressed the untrusted gzip request body and read it fully viaio.ReadAll(gz)with no size cap. A small, highly compressed payload (decompression bomb) expands to an arbitrary size in memory, exhausting host RAM and crashing the Go process (high-severity DoS).Taint path:
gzip.NewReader(r.Body)(source) →io.ReadAll(gz)(unbounded sink).Fix
io.LimitReader(gz, maxImportSize+1)so at most 10 MiB (plus one sentinel byte) of decompressed data is ever read into memory.maxImportSizeconstant (10 MiB) documenting the cap.413 Request Entity Too Largewhen the decompressed payload exceeds the limit, and400 Bad Requestwhen reading the stream fails.defer gz.Close()and stop silently discarding the read error.This addresses the root cause: decompressed input is now bounded regardless of the compressed input size.
Verification
Reviewed the resulting handler for correctness. Go toolchain is not available in the sandbox and the repository has no test infrastructure, so the change was verified by manual reasoning about the control/data flow rather than an automated run.
Automated fix by Hacktron for finding: https://staging.hacktron.ai/testestesttest/findings/26b465b5-7a48-4ab1-bbc5-ba2b4c78a6d5