HMS-11029: Set decompression size limit for comps.xml and modules.yaml

[johnelliott626]

Summary

Currently there is no decompression limit for comps.xml and modules.yaml when these files are decompressed during repository introspection. To fix this security vulnerability the PR sets in place a file decompression limit that is the same limit as what is already used for parsing compressed xml data (1.5 GB).

Testing 🧪 🔬

Point content-sources-backend to your local yummy package: 👉

go mod edit -replace github.com/content-services/yummy=/path/to/local/yummy

go mod tidy

Test happy path:😄

1. Introspect any/all repositories and should not see any errors

Test the sad path:😢

1. Change the decompression limit to be something small like 128 bytes (change the third parameter here for comps.xml or here for modules.yaml
2. Introspect any repository in content-sources-backed
3. Should see relevant error returned during introspection that signals introspection failed due to a decompression limit being exceeded.

[johnelliott626]

I didn't add the same error handling to the existing ParseCompressedXMLData function. Wasn't sure if it wasn't a big deal/ more of a if it ain't broke don't fix it kind of vibe. But lmk if I should apply the same error handling changes there! 😄

[xbhouse]

I didn't add the same error handling to the existing ParseCompressedXMLData function. Wasn't sure if it wasn't a big deal/ more of a if it ain't broke don't fix it kind of vibe. But lmk if I should apply the same error handling changes there! 😄

i think that's a good idea :) aligning behavior across all the parsing paths would maintain consistency and provide clearer errors there too

[johnelliott626]

I didn't add the same error handling to the existing ParseCompressedXMLData function. Wasn't sure if it wasn't a big deal/ more of a if it ain't broke don't fix it kind of vibe. But lmk if I should apply the same error handling changes there! 😄

i think that's a good idea :) aligning behavior across all the parsing paths would maintain consistency and provide clearer errors there too

Made the changes 🫡 😄

[xbhouse]

awesome job! this looks great :)