Restrict links and implement zip bomb detection - #211
Merged
Conversation
thelovekesh
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
This pull request strengthens archive security in the package manager by (1) disallowing symlinks/hardlinks during packing, (2) skipping link entries during extraction, and (3) adding zip-bomb style extraction limits (max decompressed size and max compression ratio).
Changes:
- Reject symlinks and hardlinks when creating archives; skip link entries when extracting.
- Add zip bomb detection during extraction (512MB decompressed cap; compression ratio guard).
- Thread a logger callback through installer/extraction so link-skips can be reported to stderr.
Reviewed changes
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
Show a summary per file
| File | Description |
|---|---|
| pkg/pm/installer/installer.go | Adds a logger hook and passes it into archive extraction options. |
| pkg/archive/archive.go | Implements link restrictions, extraction-time skipping, and zip bomb detection/limits. |
| pkg/archive/time_windows.go | Removes unused link-specific time-setting helper. |
| pkg/archive/time_nonwindows.go | Removes link-specific time-setting implementation and unix dependency. |
| pkg/archive/archive_windows.go | Removes unused inode helper. |
| pkg/archive/archive_unix.go | Removes unused inode helper and syscall import. |
| cli/command/publish/publish.go | Adds logger wiring via TarOptions (stderr output). |
| cli/command/install/run.go | Updates installer construction to provide a logger function. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Contributor
There was a problem hiding this comment.
Pull request overview
Copilot reviewed 8 out of 8 changed files in this pull request and generated 2 comments.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
thelovekesh
added
enhancement
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This update restricts the ability to pack tarballs with symlinks and hardlinks, and ensures these links are skipped while unpacking a tarball.
This decision was made after careful consideration regarding security, cross-platform distribution, and how the WordPress Zip API handles symlinks during extraction. Archive APIs and packages frequently receive security advisories related to how tarball contents can be exploited (such as directory traversal attacks). Properly mitigating these risks requires significant, ongoing maintenance and prevention.
Furthermore, there are virtually no legitimate use cases for hardlinks or symlinks within WordPress plugin or theme codebases. By completely restricting their packing and extraction, we proactively eliminate a potential attack vector and simplify the package manager's architecture.
On the security front, we’re also introducing automatic detection for zip bombs. To protect server resources from malicious archives designed to expand infinitely and crash the system, we’ve established strict new extraction limits.
From now on, a plugin or theme will be flagged as a zip bomb if its uncompressed size tops 512 MB, or if it has a wildly high compression ratio of 250:1 (99.6%). If you're wondering where that number comes from, we are following industry best practices. For example, Composer also marks packages as zip bombs if they exceed 99% compression.