Struct EntryValidator 

pub struct EntryValidator<'a> { /* private fields */ }

Orchestrates security validation for archive entries.

This type maintains state across entry validations:

• Quota tracking (file count, total size)
• Compression ratio monitoring (zip bomb detection)
• Hardlink target tracking

Lifecycle

1. Create with EntryValidator::new(&config, &dest)
2. For each entry, call validate_entry()
3. After all entries processed, call finish() for final report

Examples

use exarch_core::SecurityConfig;
use exarch_core::security::EntryValidator;
use exarch_core::types::DestDir;
use exarch_core::types::EntryType;
use std::path::Path;
use std::path::PathBuf;

let dest = DestDir::new(PathBuf::from("/tmp"))?;
let config = SecurityConfig::default();

let mut validator = EntryValidator::new(&config, &dest);

// Validate a file entry
let entry = validator.validate_entry(
    Path::new("foo/bar.txt"),
    &EntryType::File,
    1024,        // uncompressed size
    Some(512),   // compressed size
    Some(0o644), // mode
)?;

let report = validator.finish();
println!("Validated {} files", report.files_validated);

OPT-H004: Validator uses references to avoid cloning config and dest. This eliminates 1 clone per extraction (SecurityConfig + DestDir).

Implementations

impl<'a> EntryValidator<'a>

pub fn new(config: &'a SecurityConfig, dest: &'a DestDir) -> Self

Creates a new entry validator with the given security configuration.

pub fn validate_entry( &mut self, path: &Path, entry_type: &EntryType, uncompressed_size: u64, compressed_size: Option<u64>, mode: Option<u32>, ) -> Result<ValidatedEntry>

Validates an archive entry.

This method orchestrates all security validations:

1. Path validation (traversal, depth, banned components)
2. Quota checking (file size, count, total size)
3. Compression ratio validation (zip bomb detection)
4. Type-specific validation (symlink, hardlink, permissions)

Performance

Typical execution time per entry:

• Regular file (non-existing): ~1-2 μs
• Regular file (existing): ~10-50 μs (canonicalization)
• Symlink: ~10-50 μs (target resolution)
• Hardlink: ~5-10 μs (tracking update)

Errors

Returns an error if any validation fails. Common errors:

• ExtractionError::PathTraversal - Path escapes destination
• ExtractionError::QuotaExceeded - Size or count limits exceeded
• ExtractionError::ZipBomb - Compression ratio too high
• ExtractionError::SymlinkEscape - Symlink target escapes
• ExtractionError::HardlinkEscape - Hardlink target escapes
• ExtractionError::InvalidPermissions - Dangerous permissions

Examples

use exarch_core::SecurityConfig;
use exarch_core::security::EntryValidator;
use exarch_core::types::DestDir;
use exarch_core::types::EntryType;
use std::path::Path;
use std::path::PathBuf;

let dest = DestDir::new(PathBuf::from("/tmp"))?;
let config = SecurityConfig::default();
let mut validator = EntryValidator::new(&config, &dest);

let entry = validator.validate_entry(
    Path::new("file.txt"),
    &EntryType::File,
    1024,
    None,
    Some(0o644),
)?;

pub fn finish(self) -> ValidationReport

Finishes validation and returns a summary report.

This consumes the validator and returns statistics about the validation process.