Open vu3rdd opened 2 years ago
Something funny happening with github UI. Sorry. Ignore all but one of those re-review requests. :-)
@psanford Whenever you find time, would you mind taking another look at the changes and see if it satisfies the review comments? Thanks.
👍🏻 Looking forward to this getting merge
A malicious sender could insert a "zipbomb" into the transit pipe and fool the recipient by filling up the disk space. A proof of concept of that would be to modify wormhole/send.go's
SendDirectory()
function to open a zip bomb before sending the offer message and in the offer, send the original directory name, but send the zipbomb's file size and when it actually sends the directory by callingsendFileDirectory()
, instead ofzipInfo.file
, send the zipbomb's file handle. Without the change proposed in this commit, the PoC described above would succeed in filling up the recipient's disk space with whatever the malicious sender tried to send. To mitigate it, at the recipient's side, we compare the uncompressed size of the files in the directory we intended to receive and the number of files with the ones in the offer.