mirror of
https://github.com/anchore/syft.git
synced 2026-08-19 16:48:27 +02:00
6f512803d2
The decompression rule only matched the stdlib constructors, so the two cataloger sites that decompress through mholt/archives went unreported while being exactly as unbounded. Matches OpenReader on an archives.Decompressor, which picks up both. Also notes in the report text that a byte limit bounds the input and not what the consumer retains. Measured on the mtree parser: 16MB of newlines, well inside a 64MB byte cap, cost 8GB of peak heap, because the parser keeps an object per line. A site can satisfy this rule and still OOM. Worth knowing for the next rule: a type filter that fails to resolve takes the whole rule set down with "used Run() with an empty rule set" rather than just skipping that rule. Type.Is on an interface does that; Type.Implements with an m.Import is what works. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>