fix(archive): disable zip compression to prevent CPU exhaustion#655
Merged
fix(archive): disable zip compression to prevent CPU exhaustion#655
Conversation
Switch PartSize from uint64 to int64 and PartUploadConcurrency from uint to int to prevent negative TOML values from silently wrapping to max unsigned values via reflect.Convert. Add validation in Validate() rejecting invalid values. Add unit tests for the checks.
5399154 to
2a05680
Compare
Add EnableArchiveCompression config option (default: true) to control zip compression for archive downloads. When disabled, archives use zip.Store (no compression) to prevent CPU exhaustion DoS attacks from concurrent requests with uncompressible data. - Add EnableArchiveCompression bool to Configuration struct - Read config in GetArchive handler to select zip.Deflate or zip.Store - Add TestGetArchiveNoCompression test for the disabled path - Update plikd.cfg, Helm chart (values.yaml + configmap.yaml) - Add Archive Compression section to security docs - Update configuration.md, server/ARCHITECTURE.md, AGENTS.md
2a05680 to
fcfd113
Compare
94d29e7 to
9e3bbe7
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR fixes a Denial of Service (DoS) vulnerability in the Zip archive generation endpoint (
GET /archive/{uploadID}/{filename}).Previously, the
archive.Create()method was used which defaults to DEFLATE compression. If an attacker uploaded uncompressible random data up to the maximum file size limit, and then repeatedly requested the archive zip endpoint concurrently, it forced the server to spawn many goroutines furiously attempting to compress the random data. Since the data is uncompressible, this caused massive CPU exhaustion on the host machine. On smaller and less powerful servers, this simple attack vector easily pegs CPU utilization to 100% and crashes the application or makes it completely unresponsive to legitimate traffic.Fix
This PR replaces
archive.Create(name)witharchive.CreateHeader()and explicitly setsMethod: zip.Store(No Compression).By disabling compression and simply streaming the raw file bytes directly into the Zip wrapper, the archive generation consumes almost zero CPU cycles regardless of the size or entropy of the files.
Testing
zip.Storeis used in new generated archives to prevent regression.