arcthis 0.5.0

An agent-native CLI for accessing and manipulating compressed files
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137

use std::path::PathBuf;
use std::time::Duration;

use crate::error::{ArcthisError, Result};
use crate::model::EntryKind;

#[derive(Debug, Clone, Copy, PartialEq, Eq)]
pub struct ExtractionLimits {
    pub max_entries: u64,
    pub max_total_size: u64,
    pub max_entry_size: u64,
    pub max_path_bytes: usize,
    pub max_components: usize,
    pub max_compression_ratio: Option<u64>,
    pub max_entry_duration: Option<Duration>,
}

impl Default for ExtractionLimits {
    fn default() -> Self {
        Self {
            max_entries: 100_000,
            max_total_size: 16 * 1024 * 1024 * 1024,
            max_entry_size: 4 * 1024 * 1024 * 1024,
            max_path_bytes: 4_096,
            max_components: 256,
            max_compression_ratio: None,
            max_entry_duration: None,
        }
    }
}

pub(crate) fn validate_entry_path(
    path: &str,
    kind: EntryKind,
    limits: &ExtractionLimits,
) -> Result<PathBuf> {
    if path.is_empty() {
        return unsafe_path(path, "path is empty");
    }
    if path.contains('\0') {
        return unsafe_path(path, "path contains a NUL byte");
    }
    if path.len() > limits.max_path_bytes {
        return Err(ArcthisError::ResourceLimit {
            message: format!(
                "entry path uses {} bytes, above the {} byte limit",
                path.len(),
                limits.max_path_bytes
            ),
        });
    }
    if path.starts_with('/') || path.starts_with("//") {
        return unsafe_path(path, "absolute or UNC paths are not allowed");
    }
    if path.contains('\\') {
        return unsafe_path(path, "backslash separators are not allowed");
    }
    let bytes = path.as_bytes();
    if bytes.len() >= 2 && bytes[0].is_ascii_alphabetic() && bytes[1] == b':' {
        return unsafe_path(path, "Windows drive prefixes are not allowed");
    }

    let trimmed = if kind == EntryKind::Directory {
        path.trim_end_matches('/')
    } else {
        path
    };
    if trimmed.is_empty() {
        return unsafe_path(path, "path has no usable component");
    }
    let components = trimmed.split('/').collect::<Vec<_>>();
    if components.len() > limits.max_components {
        return Err(ArcthisError::ResourceLimit {
            message: format!(
                "entry path has {} components, above the {} component limit",
                components.len(),
                limits.max_components
            ),
        });
    }

    let mut result = PathBuf::new();
    for component in components {
        if component.is_empty() {
            return unsafe_path(path, "empty path components are not allowed");
        }
        if component == "." || component == ".." {
            return unsafe_path(path, "dot path components are not allowed");
        }
        if component.len() > 255 {
            return Err(ArcthisError::ResourceLimit {
                message: format!("entry path component exceeds 255 bytes: `{component}`"),
            });
        }
        result.push(component);
    }
    Ok(result)
}

fn unsafe_path<T>(path: &str, reason: &str) -> Result<T> {
    Err(ArcthisError::UnsafePath {
        path: path.to_owned(),
        reason: reason.to_owned(),
    })
}

#[cfg(test)]
mod tests {
    use super::{ExtractionLimits, validate_entry_path};
    use crate::model::EntryKind;

    #[test]
    fn accepts_normal_relative_paths() {
        let path = validate_entry_path(
            "docs/资料/readme.md",
            EntryKind::File,
            &ExtractionLimits::default(),
        )
        .expect("safe path");
        assert_eq!(path.to_string_lossy(), "docs/资料/readme.md");
    }

    #[test]
    fn rejects_parent_absolute_drive_and_backslash_paths() {
        let limits = ExtractionLimits::default();
        for path in ["../escape", "/etc/passwd", "C:/escape", r"..\escape"] {
            assert!(validate_entry_path(path, EntryKind::File, &limits).is_err());
        }
    }

    #[test]
    fn permits_one_trailing_slash_only_for_directories() {
        let limits = ExtractionLimits::default();
        assert!(validate_entry_path("empty/", EntryKind::Directory, &limits).is_ok());
        assert!(validate_entry_path("file/", EntryKind::File, &limits).is_err());
    }
}