[jira] Resolved: (TIKA-216) Zip bomb prevention

     [ https://issues.apache.org/jira/browse/TIKA-216?page=com.atlassian.jira.plugin.system.issuetabpanels:all-tabpanel ]

Jukka Zitting resolved TIKA-216.
--------------------------------

       Resolution: Fixed
    Fix Version/s: 0.4
         Assignee: Jukka Zitting

There is now a SecureContentHandler decorator class that implements a simple zip bomb prevention heuristic. By default the class throws an exception for any input documents that produce over 100 output characters per input byte, a compression ratio that no normal document is expected to reach. There is a default threshold of 1M output characters after which the zip bomb detection gets activated. This threshold avoids false positives for otherwise normal documents that for some reason start with a sequence of highly compressible data.

The SecureContentHandler decorator class is used together with the CountingInputStream from Commons IO. See below for sample usage:

    CountingInputStream count = new CountingInputStream(stream);
    SecureContentHandler secure = new SecureContentHandler(handler, count);
    try {
        parser.parse(count, secure, metadata);
    } catch (SAXException e) {
        secure.throwIfCauseOf(e);
        throw e;
    }

I added this to the AutoDetectParser, so all clients that use AutoDetectParser or tools based on that are automatically protected against simple zip bombs.



--
This message is automatically generated by JIRA.
-
You can reply to this email to add a comment to the issue online.