Skip to content

Commit

Permalink
sepinf-inc#2286: handle zip bomb for ufed messages
Browse files Browse the repository at this point in the history
  • Loading branch information
aberenguel committed Aug 20, 2024
1 parent 521152a commit 361bdca
Showing 1 changed file with 10 additions and 2 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -25,6 +25,7 @@
import org.apache.tika.mime.MediaType;
import org.apache.tika.parser.AbstractParser;
import org.apache.tika.parser.ParseContext;
import org.apache.tika.sax.SecureContentHandler;
import org.apache.tika.sax.XHTMLContentHandler;
import org.xml.sax.ContentHandler;
import org.xml.sax.SAXException;
Expand Down Expand Up @@ -178,9 +179,16 @@ public void parse(InputStream inputStream, ContentHandler handler, Metadata meta

Collections.sort(messages, new MessageComparator());

String virtualId = chat.getMetadata().get(ExtraProperties.UFED_META_PREFIX + "id");

if (extractor.shouldParseEmbedded(metadata)) {

// prevents "Suspected zip bomb" exception, since inputStream has no content
// in an example, 32834 messages resulted in 3065950 bytes in handler => ~100 bytes / message
// In addition it can be a real zip bomb with a ratio of 100
if (handler instanceof SecureContentHandler) {
((SecureContentHandler) handler).setOutputThreshold(messages.size() * 100 * 100);
}

String virtualId = chat.getMetadata().get(ExtraProperties.UFED_META_PREFIX + "id");
ReportGenerator reportGenerator = new ReportGenerator(searcher);
reportGenerator.setMinChatSplitSize(this.minChatSplitSize);
byte[] bytes = reportGenerator.generateNextChatHtml(chat, messages);
Expand Down

0 comments on commit 361bdca

Please sign in to comment.