Skip to content

HMS-11029: Set decompression size limit for comps.xml and modules.yaml - #45

Open
johnelliott626 wants to merge 7 commits into
content-services:masterfrom
johnelliott626:fix/HMS-11029-set-decompression-limit
Open

HMS-11029: Set decompression size limit for comps.xml and modules.yaml#45
johnelliott626 wants to merge 7 commits into
content-services:masterfrom
johnelliott626:fix/HMS-11029-set-decompression-limit

Conversation

@johnelliott626

@johnelliott626 johnelliott626 commented Aug 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

Currently there is no decompression limit for comps.xml and modules.yaml when these files are decompressed during repository introspection. To fix this security vulnerability the PR sets in place a file decompression limit that is the same limit as what is already used for parsing compressed xml data (1.5 GB).

Testing 🧪 🔬

Point content-sources-backend to your local yummy package: 👉

go mod edit -replace github.com/content-services/yummy=/path/to/local/yummy

go mod tidy

Test happy path:😄

  1. Introspect any/all repositories and should not see any errors

Test the sad path:😢

  1. Change the decompression limit to be something small like 128 bytes (change the third parameter here for comps.xml or here for modules.yaml
  2. Introspect any repository in content-sources-backed
  3. Should see relevant error returned during introspection that signals introspection failed due to a decompression limit being exceeded.

johnelliott626
johnelliott626 commented Aug 10, 2026
View reviewed changes
Comment thread pkg/yum/repository.go
@johnelliott626

johnelliott626 commented Aug 11, 2026

Copy link
Copy Markdown
Author

I didn't add the same error handling to the existing ParseCompressedXMLData function. Wasn't sure if it wasn't a big deal/ more of a if it ain't broke don't fix it kind of vibe. But lmk if I should apply the same error handling changes there! 😄

@johnelliott626
johnelliott626 marked this pull request as ready for review August 11, 2026 15:22
@xbhouse xbhouse self-assigned this Aug 11, 2026
@xbhouse

xbhouse commented Aug 11, 2026

Copy link
Copy Markdown
Contributor

I didn't add the same error handling to the existing ParseCompressedXMLData function. Wasn't sure if it wasn't a big deal/ more of a if it ain't broke don't fix it kind of vibe. But lmk if I should apply the same error handling changes there! 😄

i think that's a good idea :) aligning behavior across all the parsing paths would maintain consistency and provide clearer errors there too

@johnelliott626
johnelliott626 force-pushed the fix/HMS-11029-set-decompression-limit branch from 975d17e to 9f2c96f Compare August 13, 2026 17:14
@johnelliott626

johnelliott626 commented Aug 13, 2026

Copy link
Copy Markdown
Author

I didn't add the same error handling to the existing ParseCompressedXMLData function. Wasn't sure if it wasn't a big deal/ more of a if it ain't broke don't fix it kind of vibe. But lmk if I should apply the same error handling changes there! 😄

i think that's a good idea :) aligning behavior across all the parsing paths would maintain consistency and provide clearer errors there too

Made the changes 🫡 😄

xbhouse
xbhouse approved these changes Aug 14, 2026
View reviewed changes

@xbhouse xbhouse left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

awesome job! this looks great :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@xbhouse xbhouse xbhouse approved these changes

Assignees

@xbhouse xbhouse

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@johnelliott626 @xbhouse