Repository navigation
fix(tar): enforce limits for stdout extraction - #1946
Merged
Merged
Conversation
There was a problem hiding this comment.
Pull request overview
This PR hardens tar -xO extraction in bashkit by enforcing the same filesystem quota limits used for VFS writes, preventing untrusted archives from bypassing max_file_size / max_total_bytes via stdout extraction.
Changes:
- Apply
FsLimits::check_file_sizeandFsLimits::check_total_bytesbefore appending extracted file content to in-memory stdout fortar -O. - Add a
build_tar_with_entriestest helper for composing multi-entry tar fixtures. - Add two unit tests covering per-file and cumulative stdout quota enforcement for
tar -xO.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+599
to
+611
| if let Err(err) = limits.check_file_size(size as u64) { | ||
| return Ok(ExecResult::err(format!("tar: {name}: {err}\n"), 2)); | ||
| } | ||
|
|
||
| let output = String::from_utf8_lossy(content); | ||
| if let Err(err) = | ||
| limits.check_total_bytes(stdout_output.len() as u64, output.len() as u64) | ||
| { | ||
| return Ok(ExecResult::err(format!("tar: {name}: {err}\n"), 2)); | ||
| } | ||
|
|
||
| // -O: write content to stdout after applying VFS-sized quotas. | ||
| stdout_output.push_str(&output); |
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
bashkit | 0aff55e | Commit Preview URL | Jun 05 2026, 08:04 PM |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
tar -Oappended extracted file bytes directly to an in-memorystdoutstring and skipped VFS write checks, allowing per-file and cumulative output to bypassmax_file_sizeandmax_total_bytesquotas.Description
limits.check_file_size(size as u64)before converting/adding a file to stdout.limits.check_total_bytes(current_stdout_len, output_len)using the post-conversion byte length before appending.build_tar_with_entrieshelper and two unit tests:test_tar_extract_stdout_enforces_file_size_limitandtest_tar_extract_stdout_enforces_total_output_limitto cover per-file and total-output rejection cases.Testing
cargo fmt --checkand applied formatting; check passed.cargo test -p bashkit builtins::archive::tests, which passed (all archive tests including the two new tests succeeded).cargo test -p bashkit test_tar_extract_stdout_enforces*, which passed.Codex Task