Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add a limit to the size of the metadata and checksums files in a gem package. #7568

Merged
merged 2 commits into from Apr 30, 2024
Merged

Add a limit to the size of the metadata and checksums files in a gem package. #7568

merged 2 commits into from Apr 30, 2024

Commits on Apr 28, 2024

  1. Add a limit to the size of the metadata and checksums files in a gem … 

    …package.

This is to prevent a malicious gem from causing a denial of service by
including a very large metadata or checksums file,
which is then read into memory in its entirety just by opening the gem package.

This is guaranteed to limit the amount of memory needed, since
gzips (which use deflate streams for compression) have a maximum compression
ratio of 1032:1, so the uncompressed size of the metadata or checksums file
will be at most 1032 times the size of the (limited) amount of data read.

This prevents a gem from causing 500GB of memory to be allocated
to read a 500MB metadata file.
    @segiddins
    segiddins committed Apr 28, 2024
    Configuration menu
    Copy the full SHA
    a596e3c View commit details
    Browse the repository at this point in the history

  2. Update lib/rubygems/package.rb

    @segiddins
    segiddins committed Apr 28, 2024
    Configuration menu
    Copy the full SHA
    c4e75b9 View commit details
    Browse the repository at this point in the history