Alex Goodman c38a68e9de fix: hold archive chains to the same bounds when scanning and decoding ...

Decoding SPDX, CycloneDX and syft-json rebuilt nested archive chains from whatever the document said, with no checks on entry names, depth or length. A small crafted document could forge archive boundaries or cost memory quadratic in its size (a 3 MB SPDX allocated ~14 GB).

- decoders now hold names to the scan's `EntryName` rules, and chains to `MaxDepth` (16) and PATH_MAX in length
- a file within a refused chain is dropped, rather than moved to a top-level path or merged into its outer archive
- the scan holds itself to the same bounds, so its SBOMs always decode back: a configured `nested-archive-max-depth` past 16 stops at 16, and an entry whose chain would be too long is skipped and the archive reported as truncated

Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>

2026-10-29 15:50:03 -04:00

..

archive_nesting_test.go

fix: file selection within archives, spdx / cyclonedx file representation

2026-10-27 14:52:18 -04:00

archive_tasks_test.go

fix: hold archive chains to the same bounds when scanning and decoding

2026-10-29 15:50:03 -04:00

archive_tasks.go

fix: hold archive chains to the same bounds when scanning and decoding

2026-10-29 15:50:03 -04:00

cataloging_config.go

feat: 3626 add option enable license content; disable by default (#3631)

2025-02-05 20:41:03 +00:00

environment_tasks.go

chore(deps): update tools to latest versions (#2616)

2024-02-14 14:59:49 +00:00

executor_test.go

fix: don't fail the whole SBOM when a cataloger panics on one file (#5342)

2026-09-29 09:21:03 -04:00

executor.go

fix: don't fail the whole SBOM when a cataloger panics on one file (#5342)

2026-09-29 09:21:03 -04:00

expression_test.go

Add file catalogers to selection configuration (#3505)

2025-02-03 19:10:17 +00:00

expression.go

Add file catalogers to selection configuration (#3505)

2025-02-03 19:10:17 +00:00

factory.go

Add file catalogers to selection configuration (#3505)

2025-02-03 19:10:17 +00:00

feature_detection.go

feat: RHEL EUS detection (#4023)

2025-07-07 14:11:20 +00:00

file_tasks_test.go

fix: unknowns, better full vs local path handling

2026-10-20 11:15:17 -04:00

file_tasks.go

fix: unknowns, better full vs local path handling

2026-10-20 11:15:17 -04:00

package_task_factory_test.go

fix: file selection within archives, spdx / cyclonedx file representation

2026-10-27 14:52:18 -04:00

package_task_factory.go

fix: file selection within archives, spdx / cyclonedx file representation

2026-10-27 14:52:18 -04:00

package_tasks.go

feat: catalog CPAN distributions installed by perl clients (#5131)

2026-09-30 14:15:05 -04:00

relationship_tasks.go

Resolve owned file paths when searching for overlaps (#3828)

2025-04-24 21:59:45 +00:00

scope_tasks.go

fix: keep RealPath as top-level, use FullPath and utility functions FullNestedPath, LocalPath, Path

2026-10-19 15:44:37 -04:00

selection_test.go

Add file catalogers to selection configuration (#3505)

2025-02-03 19:10:17 +00:00

selection.go

Add file catalogers to selection configuration (#3505)

2025-02-03 19:10:17 +00:00

set_test.go

Replace core SBOM-creation API with builder pattern (#1383)

2024-01-12 17:39:13 -05:00

set.go

Replace core SBOM-creation API with builder pattern (#1383)

2024-01-12 17:39:13 -05:00

task.go

Replace core SBOM-creation API with builder pattern (#1383)

2024-01-12 17:39:13 -05:00

unknowns_tasks_test.go

fix: file selection within archives, spdx / cyclonedx file representation

2026-10-27 14:52:18 -04:00

unknowns_tasks.go

fix: file selection within archives, spdx / cyclonedx file representation

2026-10-27 14:52:18 -04:00