uploads: allow uploading .zip, .rar., and .7z files from disk.

Browse Source

Allow uploading .zip, .rar, and .7z files from disk. The archive will be extracted and the images
inside will be uploaded.

This only works for archive files uploaded from disk, not from a source URL.

Post source URLs will look something like this: "file://foo.zip/1.jpg", "file://foo.zip/2.jpg", etc.
Sometimes artists uses Shift JIS or other encodings instead of UTF-8 for filenames. In these cases
we just assume the filename is UTF-8 and replace invalid characters with '?', so filenames might be
wrong in some cases.

There are various protections to prevent uploading malicious archive files:

* Archives with more than 100 files aren't allowed.
* Archives that decompress to more than 100MB aren't allowed.
* Archives with filenames containing '..' components aren't allowed (e.g. '../../../../../etc/passwd').
* Archives with filenames containing absolute paths aren't allowed (e.g. '/etc/passwd').
* Archives containing symlinks aren't allowed (e.g. 'foo -> /etc/passwd').
* Archive types other than .zip, .rar, and .7z aren't allowed (e.g. .tar.gz, .cpio).
* File permissions, owners, and other metadata are ignored.

Partial fix for #5340: Add support for extracting archive attachments from certain sources

...

This commit is contained in:

evazion

2022-11-16 01:53:50 -06:00

parent d791924aad

commit 2deae38a4e

14 changed files with 232 additions and 31 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

BIN

test/files/archive/42.zip Normal file

Binary file not shown.

BIN

test/files/archive/absolute-path.7z Normal file

Binary file not shown.

BIN

test/files/archive/bomb-1-1G.rar Normal file

Binary file not shown.

BIN

test/files/archive/bomb-100-10M.rar Normal file

Binary file not shown.

BIN

test/files/archive/bomb-10k-files.7z Normal file

Binary file not shown.

BIN

test/files/archive/symlink.zip Normal file

Binary file not shown.

BIN

test/files/archive/ugoira.tar Normal file

Binary file not shown.

BIN

test/files/archive/ugoira.tar.7z

Binary file not shown.

BIN

test/files/archive/ugoira.tar.gz Normal file

Binary file not shown.

BIN

test/files/archive/zip-slip.zip Normal file

Binary file not shown.