Preflight ZIP central directory metadata (T-612)

core/installer/limits.go

@@ -9,23 +9,29 @@ import (
 var ErrInvalidLimits = errors.New("invalid ZIP extraction limits")
 
 const (
-	DefaultMaxEntries           = 10_000
-	DefaultMaxUncompressedBytes = int64(4 * 1024 * 1024 * 1024)
-	DefaultMaxCompressionRatio  = 200.0
+	DefaultMaxEntries               = 10_000
+	DefaultMaxArchiveBytes          = int64(4 * 1024 * 1024 * 1024)
+	DefaultMaxCentralDirectoryBytes = int64(64 * 1024 * 1024)
+	DefaultMaxUncompressedBytes     = int64(4 * 1024 * 1024 * 1024)
+	DefaultMaxCompressionRatio      = 200.0
 )
 
 // Limits bounds archive metadata and decompressed output.
 type Limits struct {
-	MaxEntries           int
-	MaxUncompressedBytes int64
-	MaxCompressionRatio  float64
+	MaxEntries               int
+	MaxArchiveBytes          int64
+	MaxCentralDirectoryBytes int64
+	MaxUncompressedBytes     int64
+	MaxCompressionRatio      float64
 }
 
 func DefaultLimits() Limits {
 	return Limits{
-		MaxEntries:           DefaultMaxEntries,
-		MaxUncompressedBytes: DefaultMaxUncompressedBytes,
-		MaxCompressionRatio:  DefaultMaxCompressionRatio,
+		MaxEntries:               DefaultMaxEntries,
+		MaxArchiveBytes:          DefaultMaxArchiveBytes,
+		MaxCentralDirectoryBytes: DefaultMaxCentralDirectoryBytes,
+		MaxUncompressedBytes:     DefaultMaxUncompressedBytes,
+		MaxCompressionRatio:      DefaultMaxCompressionRatio,
 	}
 }
 
@@ -33,6 +39,15 @@ func (limits Limits) validate() error {
 	if limits.MaxEntries <= 0 {
 		return fmt.Errorf("%w: MaxEntries must be positive", ErrInvalidLimits)
 	}
+	if limits.MaxArchiveBytes <= 0 {
+		return fmt.Errorf("%w: MaxArchiveBytes must be positive", ErrInvalidLimits)
+	}
+	if limits.MaxCentralDirectoryBytes <= 0 {
+		return fmt.Errorf("%w: MaxCentralDirectoryBytes must be positive", ErrInvalidLimits)
+	}
+	if limits.MaxCentralDirectoryBytes > limits.MaxArchiveBytes {
+		return fmt.Errorf("%w: MaxCentralDirectoryBytes exceeds MaxArchiveBytes", ErrInvalidLimits)
+	}
 	if limits.MaxUncompressedBytes <= 0 {
 		return fmt.Errorf("%w: MaxUncompressedBytes must be positive", ErrInvalidLimits)
 	}