mirror of
https://github.com/anchore/syft.git
synced 2026-10-31 06:26:30 +01:00
Alex Goodman
81ee189bf4
the limiter bounds what's held *at once*, and each archive gives its bytes back when it's released. So a recursive bomb (42.zip shape) never trips a limit: every level fits on its own, and the scan just runs for effectively forever. Capping each archive at N× its own size wouldn't help either, since every level of such a bomb is high-ratio, so the work still grows about N-fold per level. - each top-level archive gets one decompression budget of `max(100 × its size, 1 GiB)`, spent by every archive nested under it at any depth - the budget is attached to the context when the walk enters a top-level archive, so `Extract` picks it up without a signature change - once it's spent, the archive being extracted is truncated with a "possible decompression bomb" unknown and the walk moves on. The next top-level archive starts fresh real trees (a war of jars, a layer of tarballs) expand a few times over, well under the ratio. Signed-off-by: Alex Goodman <wagoodman@users.noreply.github.com>
82 lines
3.2 KiB
Go
82 lines
3.2 KiB
Go
package archive
|
|
|
|
import (
|
|
"context"
|
|
"strings"
|
|
|
|
"github.com/anchore/syft/syft/file"
|
|
)
|
|
|
|
// Traversal describes the archive whose contents a cataloger is running against. The archive
|
|
// cataloger task puts one on the context before running catalogers inside an archive, so a cataloger
|
|
// such as java can describe the archive it is inside without owning the recursion.
|
|
type Traversal struct {
|
|
// Location is the archive file's location within its parent filesystem, including the access path
|
|
// it was reached by. Its ArchivePath names the archives above it, so VirtualPath(Location) is the
|
|
// full chain from the scan root as seen through that access path. The ArchivePath of the files
|
|
// inside it is built from the real path instead.
|
|
Location file.Location
|
|
|
|
// Digests are of the archive file itself, taken during extraction; a cataloger running inside the
|
|
// archive cannot compute them since the archive is not inside itself.
|
|
Digests []file.Digest
|
|
}
|
|
|
|
// VirtualPath returns the colon-delimited chain of archives from the scan root to loc, ending in loc
|
|
// itself: "app.war:WEB-INF/lib/dep.jar". Outside any archive it is the location's path unchanged. In an
|
|
// entry name '%' is escaped as "%25" and then ':' as "%3A", so splitting on ':' recovers the archive
|
|
// boundaries and no two entry names share an escaped form. The leading slash is dropped to match the
|
|
// java cataloger, which joins slash-less zip entry names onto the containing archive's path.
|
|
func VirtualPath(loc file.Location) string {
|
|
if loc.ArchivePath == "" {
|
|
return loc.Path()
|
|
}
|
|
return loc.ArchivePath + ":" + strings.TrimPrefix(escapeEntryPath(loc.Path()), "/")
|
|
}
|
|
|
|
var entryPathEscaper = strings.NewReplacer("%", "%25", ":", "%3A")
|
|
|
|
func escapeEntryPath(p string) string {
|
|
return entryPathEscaper.Replace(p)
|
|
}
|
|
|
|
type traversalCtxKey struct{}
|
|
|
|
func WithTraversal(ctx context.Context, t *Traversal) context.Context {
|
|
return context.WithValue(ctx, traversalCtxKey{}, t)
|
|
}
|
|
|
|
// TraversalFromContext returns the archive traversal on the context, or nil outside an archive.
|
|
func TraversalFromContext(ctx context.Context) *Traversal {
|
|
t, _ := ctx.Value(traversalCtxKey{}).(*Traversal)
|
|
return t
|
|
}
|
|
|
|
type budgetCtxKey struct{}
|
|
|
|
// WithBudget sets the decompression budget that Extract spends from, for this archive and every archive
|
|
// extracted beneath it.
|
|
func WithBudget(ctx context.Context, b *Budget) context.Context {
|
|
return context.WithValue(ctx, budgetCtxKey{}, b)
|
|
}
|
|
|
|
func budgetFromContext(ctx context.Context) *Budget {
|
|
b, _ := ctx.Value(budgetCtxKey{}).(*Budget)
|
|
return b
|
|
}
|
|
|
|
type nestedCatalogingCtxKey struct{}
|
|
|
|
// WithNestedCataloging marks the context of a scan whose archive cataloger task will extract every
|
|
// archive and run the catalogers inside it. syft.CreateSBOM sets it before any task runs, so a
|
|
// cataloger that would otherwise open archives itself can leave them to the task instead.
|
|
func WithNestedCataloging(ctx context.Context) context.Context {
|
|
return context.WithValue(ctx, nestedCatalogingCtxKey{}, true)
|
|
}
|
|
|
|
// NestedCatalogingEnabled reports whether the archive cataloger task is extracting archives in this scan.
|
|
func NestedCatalogingEnabled(ctx context.Context) bool {
|
|
enabled, _ := ctx.Value(nestedCatalogingCtxKey{}).(bool)
|
|
return enabled
|
|
}
|