oci/zeronet
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Read max 6MB from archive to protect against tar/zipbombs

Browse source
This commit is contained in:
shortcutme 2017-07-12 12:28:03 +02:00
parent e525ea2431
commit 2777c4c537
No known key found for this signature in database
GPG key ID: 5B63BAE6CB9613AE
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
plugins/FilePack/FilePackPlugin.py
View file

@ -66,7 +66,7 @@ class UiRequestPlugin(object):
return super(UiRequestPlugin, self).actionSiteMedia(path, **kwargs) return super(UiRequestPlugin, self).actionSiteMedia(path, **kwargs)
def streamFile(self, file): def streamFile(self, file):
while 1: for i in range(100): # Read max 6MB
try: try:
block = file.read(60 * 1024) block = file.read(60 * 1024)
if block: if block: