Blame · Line-by-line history
bounded-gunzip.ts
Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.
| 303c5e2 | 1 | /** |
| 2 | * Size-bounded gzip decompression. | |
| 3 | * | |
| 4 | * `Bun.gunzipSync` has two properties that make it unsafe on a request path | |
| 5 | * carrying attacker-controlled bytes: | |
| 6 | * | |
| 7 | * 1. No output bound. gzip reaches compression ratios past 1000:1 on | |
| 8 | * repetitive input, so a 10 MB upload expands to ~10 GB in memory. The | |
| 9 | * process is killed long before that completes. | |
| 10 | * 2. It is synchronous. Decompression blocks the event loop for its whole | |
| 11 | * duration, so a single large body stalls every other request the | |
| 12 | * server is handling — a latency DoS independent of the memory one. | |
| 13 | * | |
| 14 | * This helper streams through `DecompressionStream`, checks a running total | |
| 15 | * after every chunk, and aborts the moment the budget is exceeded. Memory is | |
| 16 | * bounded by `limit` rather than by the compression ratio, and awaiting each | |
| 17 | * chunk yields to the event loop instead of monopolising it. | |
| 18 | */ | |
| 19 | ||
| 20 | /** Thrown when decompressed output exceeds the caller's budget. */ | |
| 21 | export class DecompressedTooLargeError extends Error { | |
| 22 | readonly limit: number; | |
| 23 | constructor(limit: number) { | |
| 24 | super(`decompressed body exceeds ${limit} bytes`); | |
| 25 | this.name = "DecompressedTooLargeError"; | |
| 26 | this.limit = limit; | |
| 27 | } | |
| 28 | } | |
| 29 | ||
| 30 | /** | |
| 31 | * Default ceiling for a git push body after decompression. | |
| 32 | * | |
| 33 | * Generous on purpose: git objects inside a packfile are already zlib | |
| 34 | * compressed, so a genuine push gzips at close to 1:1 and a real one this | |
| 35 | * large would be extraordinary. A bomb, by contrast, blows through this | |
| 36 | * within the first few chunks and is cut off there. | |
| 37 | */ | |
| 38 | export const MAX_GIT_BODY_BYTES = 1024 * 1024 * 1024; // 1 GiB | |
| 39 | ||
| 40 | /** True if `bytes` starts with the gzip magic number. */ | |
| 41 | export function isGzip(bytes: Uint8Array): boolean { | |
| 42 | return bytes.length >= 2 && bytes[0] === 0x1f && bytes[1] === 0x8b; | |
| 43 | } | |
| 44 | ||
| 45 | /** | |
| 46 | * Decompress `input`, refusing to buffer more than `limit` bytes of output. | |
| 47 | * | |
| 48 | * @throws {DecompressedTooLargeError} as soon as the budget is exceeded — | |
| 49 | * before the offending data is retained, not after. | |
| 50 | */ | |
| 51 | export async function gunzipBounded( | |
| 52 | input: Uint8Array, | |
| 53 | limit: number = MAX_GIT_BODY_BYTES | |
| 54 | ): Promise<Uint8Array> { | |
| 55 | const stream = new Blob([input as BlobPart]) | |
| 56 | .stream() | |
| 57 | .pipeThrough(new DecompressionStream("gzip")); | |
| 58 | ||
| 59 | const reader = stream.getReader(); | |
| 60 | const chunks: Uint8Array[] = []; | |
| 61 | let total = 0; | |
| 62 | ||
| 63 | try { | |
| 64 | while (true) { | |
| 65 | const { done, value } = await reader.read(); | |
| 66 | if (done) break; | |
| 67 | if (!value) continue; | |
| 68 | ||
| 69 | total += value.byteLength; | |
| 70 | // Check BEFORE retaining the chunk, so exceeding the budget never | |
| 71 | // costs more than one chunk of headroom. | |
| 72 | if (total > limit) { | |
| 73 | throw new DecompressedTooLargeError(limit); | |
| 74 | } | |
| 75 | chunks.push(value); | |
| 76 | } | |
| 77 | } finally { | |
| 78 | // Releases the underlying source whether we finished or bailed out. | |
| 79 | reader.cancel().catch(() => {}); | |
| 80 | } | |
| 81 | ||
| 82 | const out = new Uint8Array(total); | |
| 83 | let offset = 0; | |
| 84 | for (const chunk of chunks) { | |
| 85 | out.set(chunk, offset); | |
| 86 | offset += chunk.byteLength; | |
| 87 | } | |
| 88 | return out; | |
| 89 | } |