Alex Goodman d27b6ebb1b fix: cap each extracted archive entry at 2 GB ...

`put` had no per-entry cap, unlike the legacy java path which capped every file at 2 GB through `intFile.SafeCopy`. At depth 1, one entry of an overlapping-entry zip bomb could decompress all the way to the 100 GB disk limit before anything stopped it.

- entries are now read through the same 2 GB cap (`intFile.PerFileReadLimit`, now exported). An entry over it is dropped after cap+1 bytes and the rest of the archive is still extracted
- `Resolver` gains `TruncatedReason`, so the truncation unknown says what happened ("an entry larger than 2.0 GiB was skipped", or the existing disk-limit text) instead of always blaming the limits

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

2026-09-24 13:21:08 -04:00

..

testdata

chore: migrate fixtures to testdata (#4651)

2026-03-06 19:42:04 +00:00

archive_aliases_test.go

fix:handle compound aliases like ``.tgz`` when cataloging archives (#4421)

2025-12-02 16:55:32 -05:00

archive_aliases.go

fix:handle compound aliases like ``.tgz`` when cataloging archives (#4421)

2025-12-02 16:55:32 -05:00

copy_test.go

feat: initial recursive archive cataloging impl

2026-09-10 08:45:36 -04:00

copy.go

fix: cap each extracted archive entry at 2 GB

2026-09-24 13:21:08 -04:00

digest_test.go

chore: migrate fixtures to testdata (#4651)

2026-03-06 19:42:04 +00:00

digest.go

fix: use correct hashes for empty files (#4620)

2026-02-24 09:52:29 -05:00

getter_test.go

chore(deps): update Go version (#4773)

2026-04-15 10:01:39 -04:00

getter.go

Add ability to scan snaps (as a source) (#3929)

2025-06-25 16:53:35 -04:00

normalize_hashes_test.go

Deduplicate digests from user configuration (#2522)

2024-01-19 21:51:55 +00:00

normalize_hashes.go

Deduplicate digests from user configuration (#2522)

2024-01-19 21:51:55 +00:00

opener.go

improve doc comments

2020-11-17 12:37:13 -05:00

reader_size_test.go

fix(golang): bound allocations from UPX-packed binary headers (#5195)

2026-09-10 09:21:19 -04:00

reader_size.go

fix(golang): bound allocations from UPX-packed binary headers (#5195)

2026-09-10 09:21:19 -04:00

squashfs_test.go

chore(deps): bump the go-minor-patch group across 2 directories with 14 updates (#4947)

2026-06-04 17:06:25 -04:00

squashfs.go

chore(deps): bump the go-minor-patch group across 2 directories with 14 updates (#4947)

2026-06-04 17:06:25 -04:00

tar_file_traversal.go

feat: initial recursive archive cataloging impl

2026-09-10 08:45:36 -04:00

zip_file_helpers_test.go

chore: migrate fixtures to testdata (#4651)

2026-03-06 19:42:04 +00:00

zip_file_manifest_test.go

chore: simplify and cleanup

2026-09-22 00:23:36 -04:00

zip_file_manifest.go

chore: simplify and cleanup

2026-09-22 00:23:36 -04:00

zip_file_traversal_test.go

chore: revert custom index in favor of key_Split

2026-09-20 11:22:10 -04:00

zip_file_traversal.go

chore: revert custom index in favor of key_Split

2026-09-20 11:22:10 -04:00