This is an automated email from the ASF dual-hosted git repository.
tballison pushed a commit to branch branch_3x
in repository https://gitbox.apache.org/repos/asf/tika.git
The following commit(s) were added to refs/heads/branch_3x by this push:
new 0632641c8d TIKA-4985: raise the default zip-bomb ratio from 100 to
1000 (backport of #3378) (#3472)
0632641c8d is described below
commit 0632641c8d9dea69e6719adfcebe6335c01b4829
Author: Tim Allison <[email protected]>
AuthorDate: Sun Nov 1 15:02:52 2026 -0500
TIKA-4985: raise the default zip-bomb ratio from 100 to 1000 (backport of
#3378) (#3472)
---
CHANGES.txt | 6 ++++
.../org/apache/tika/sax/SecureContentHandler.java | 2 +-
.../apache/tika/sax/SecureContentHandlerTest.java | 2 +-
.../tika/parser/RecursiveParserWrapperTest.java | 40 +++++++++++++++++-----
4 files changed, 40 insertions(+), 10 deletions(-)
diff --git a/CHANGES.txt b/CHANGES.txt
index 99832430e3..0183e5c4b1 100644
--- a/CHANGES.txt
+++ b/CHANGES.txt
@@ -1,5 +1,11 @@
Release 3.4.0 - ???
+ * The default zip-bomb ratio (AutoDetectParserConfig
maximumCompressionRatio) is 1000,
+ up from 100. The ratio is now measured across the whole embedded tree
against the
+ container's bytes, so nested compression is still caught; at 100, ordinary
compressed
+ logs and text tripped it. Set maximumCompressionRatio to 100 to restore
the old limit
+ (TIKA-4985).
+
* A RAR entry junrar fails to extract is recorded as
X-TIKA:EXCEPTION:embedded_stream_exception on the container; what was
extracted
before the failure is kept and the rest of the archive is parsed (junrar
8.1.2,
diff --git
a/tika-core/src/main/java/org/apache/tika/sax/SecureContentHandler.java
b/tika-core/src/main/java/org/apache/tika/sax/SecureContentHandler.java
index 015e8467f3..f002a9f0cc 100644
--- a/tika-core/src/main/java/org/apache/tika/sax/SecureContentHandler.java
+++ b/tika-core/src/main/java/org/apache/tika/sax/SecureContentHandler.java
@@ -64,7 +64,7 @@ public class SecureContentHandler extends
ContentHandlerDecorator {
/**
* Maximum compression ratio.
*/
- private long ratio = 100;
+ private long ratio = 1000;
/**
* Maximum XML element nesting level.
diff --git
a/tika-core/src/test/java/org/apache/tika/sax/SecureContentHandlerTest.java
b/tika-core/src/test/java/org/apache/tika/sax/SecureContentHandlerTest.java
index 421e6c2ecb..08fa148ad1 100644
--- a/tika-core/src/test/java/org/apache/tika/sax/SecureContentHandlerTest.java
+++ b/tika-core/src/test/java/org/apache/tika/sax/SecureContentHandlerTest.java
@@ -89,7 +89,7 @@ public class SecureContentHandlerTest {
@Test
public void testManyCharactersPerByte() throws IOException {
try {
- char[] ch = new char[1000];
+ char[] ch = new char[2000];
for (int i = 0; i < MANY_BYTES; i++) {
stream.read();
handler.characters(ch, 0, ch.length);
diff --git
a/tika-parsers/tika-parsers-standard/tika-parsers-standard-package/src/test/java/org/apache/tika/parser/RecursiveParserWrapperTest.java
b/tika-parsers/tika-parsers-standard/tika-parsers-standard-package/src/test/java/org/apache/tika/parser/RecursiveParserWrapperTest.java
index 34272fb926..56c2a86cd5 100644
---
a/tika-parsers/tika-parsers-standard/tika-parsers-standard-package/src/test/java/org/apache/tika/parser/RecursiveParserWrapperTest.java
+++
b/tika-parsers/tika-parsers-standard/tika-parsers-standard-package/src/test/java/org/apache/tika/parser/RecursiveParserWrapperTest.java
@@ -519,6 +519,37 @@ public class RecursiveParserWrapperTest extends TikaTest {
@Test
public void testCompressionRatioAcrossEmbedded() throws Exception {
+ // one deflate layer stays under the default ratio; the check across
the tree is what's under test
+ AutoDetectParserConfig config = new AutoDetectParserConfig();
+ config.setMaximumCompressionRatio(100);
+ AutoDetectParser parser = new AutoDetectParser();
+ parser.setAutoDetectParserConfig(config);
+ RecursiveParserWrapper wrapper = new RecursiveParserWrapper(parser);
+ RecursiveParserWrapperHandler handler = new
RecursiveParserWrapperHandler(
+ new
BasicContentHandlerFactory(BasicContentHandlerFactory.HANDLER_TYPE.TEXT, -1));
+ try (TikaInputStream tis = TikaInputStream.get(gzippedText())) {
+ TikaException e = assertThrows(TikaException.class,
+ () -> wrapper.parse(tis, handler, new Metadata(), new
ParseContext()));
+ assertTrue(e.getMessage().contains("Zip bomb"));
+ }
+ }
+
+ @Test
+ public void testCompressedTextUnderDefaultRatio() throws Exception {
+ RecursiveParserWrapper wrapper = new
RecursiveParserWrapper(AUTO_DETECT_PARSER);
+ RecursiveParserWrapperHandler handler = new
RecursiveParserWrapperHandler(
+ new
BasicContentHandlerFactory(BasicContentHandlerFactory.HANDLER_TYPE.TEXT, -1));
+ try (TikaInputStream tis = TikaInputStream.get(gzippedText())) {
+ wrapper.parse(tis, handler, new Metadata(), new ParseContext());
+ }
+ List<Metadata> metadataList = handler.getMetadataList();
+ assertEquals(2, metadataList.size());
+
assertNull(metadataList.get(0).get(TikaCoreProperties.CONTAINER_EXCEPTION));
+
assertTrue(metadataList.get(1).get(TikaCoreProperties.TIKA_CONTENT).length() >
1_000_000);
+ }
+
+ //~2 MB of text, a few KB compressed: a ratio between 100 and 1000
+ private static byte[] gzippedText() throws IOException {
ByteArrayOutputStream bos = new ByteArrayOutputStream();
try (GZIPOutputStream gz = new GZIPOutputStream(bos)) {
byte[] line = ("a ".repeat(50) +
"\n").getBytes(StandardCharsets.US_ASCII);
@@ -526,14 +557,7 @@ public class RecursiveParserWrapperTest extends TikaTest {
gz.write(line);
}
}
- RecursiveParserWrapper wrapper = new
RecursiveParserWrapper(AUTO_DETECT_PARSER);
- RecursiveParserWrapperHandler handler = new
RecursiveParserWrapperHandler(
- new
BasicContentHandlerFactory(BasicContentHandlerFactory.HANDLER_TYPE.TEXT, -1));
- try (TikaInputStream tis = TikaInputStream.get(bos.toByteArray())) {
- TikaException e = assertThrows(TikaException.class,
- () -> wrapper.parse(tis, handler, new Metadata(), new
ParseContext()));
- assertTrue(e.getMessage().contains("Zip bomb"));
- }
+ return bos.toByteArray();
}
private List<Metadata> getMetadata(Metadata metadata,
