feat: add zip extraction support#5746
Conversation
Could you send me some examples? |
These issues discuss this function (#5723, #3210, #2768, #2316, #1541, and #3529). I know that a partial solution has been found using "command execution," but its use hasn't been very clear and is somewhat risky. The idea I propose with this pull request is a decompression tool handled directly by Go, making it a bit safer and allowing this function to be readily available from the Filebrowser interface. |
| ImageResolutionCal bool `json:"imageResolutionCalculation"` | ||
| AuthHook string `json:"authHook"` | ||
| TokenExpirationTime string `json:"tokenExpirationTime"` | ||
| UnzipEnabled bool `json:"unzipEnabled"` |
There was a problem hiding this comment.
For consistency with other settings:
| UnzipEnabled bool `json:"unzipEnabled"` | |
| UnzipEnabled bool `json:"enableUnzip"` |
| flags.Bool("disableExec", true, "disables Command Runner feature") | ||
| flags.Bool("disableTypeDetectionByHeader", false, "disables type detection by reading file headers") | ||
| flags.Bool("disableImageResolutionCalc", false, "disables image resolution calculation by reading image files") | ||
| flags.Bool("unzipEnabled", false, "enable zip file extraction") |
There was a problem hiding this comment.
All other flags are --disable{Functionality}. I'd rather stay consistent here, unless there's a good reason not to.
There was a problem hiding this comment.
Oh right, I know it doesn't really follow the structure that has been used so far in the project; I would like to be able to implement it as you suggest. I did it the other way around because I didn't want to 'affect' users who were already running filebrowser and might not want this zip extraction feature for security reasons, but I don't think it will bother them. In the way you mention, if a user doesn't want this functionality, they can disable it with the flag --disable{Functionality}. If you tell me that the --disable{Functionality} approach is correct for the project, I will do it that way.
There was a problem hiding this comment.
Hmm... you do have a point. The only disable that is on by default is --disableExec, so that could be technically done.
However, making it --disableX would not affect existing installations I think. Because the --disable flag is an override. The default setting for new users would be True, but for existing users, the new field in the settings would still be False.
I think if we go with that approach, it'd work and be consistent. Other features have been added with time, making them enabled by default for new installations only.
Description
This PR introduces a secure and configurable unzip handler to FileBrowser. It adds server‑level configuration options with sensible defaults and enforces multiple safety checks to prevent ZIP bombs, path traversal, and denial‑of‑service scenarios.
The zip file extraction function is disabled by default and can be enabled by using the
--unzipEnabledflag or by enabling it throughfilebrowser config set.Key changes
MaxZipFileSize(default: 5GB): Maximum size of zip files that can be extracted (large files may cause DoS attacks).MaxZipFileEntries(default: 100k files): Maximum number of files in the zip archive (zip archives with too many files can trigger DoS attacks).MaxTotalUncompressedSize(default: 20GB): This is the disk space that the file will occupy once it is fully decompressed (a necessary check to avoid completely filling up the available disk space and crashing the system).MaxUncompressedSizeRate(default: 0.01 → 1%): The ratio between the size of each compressed and uncompressed file (prevents zip bomb attacks). Some malicious files (zip bombs) can "lie" about their uncompressed size, so every time a file is extracted from the zip archive, it is checked that the size it occupies on the disk matches the size declared in the zip file (if they don't match, the zip file "lies" and the extraction is stopped immediately because it is considered a corrupt or malicious file).MaxUncompressedFileSize(default: 5GB): Maximum size that each uncompressed file can occupy (avoids using up all available disk space and crashing the system).Uses io.LimitReaderto guard against infinite streams and oversized files.Additional Information
Extracting compressed files is a highly requested feature in the project, and an optional, clear, and secure implementation is necessary for some users.
Checklist
Before submitting your PR, please indicate which issues are either fixed or closed by this PR. See GitHub Help: Closing issues using keywords.
masterbranch.