fix(security): bound ZIP metadata and stream TAR traversal

[SHAURYAKSHARMA24]

Summary

Preflight actual ZIP central-directory bytes and entry headers before ZipInfo allocation; cap metadata at 16 MiB and configured entry count. Stream TAR members, validate/extract each under existing entry/decompressed-size and path/link/device safeguards, and clear retained TarInfo objects.

Linked issue

Related to #542.

Scope

Audit F12; baseline dev df0e82be3d7b2b7d846eefc1bcf82bde834936f2. This corrects independently verified existing behavior and advances the linked issue without adding product scope.

What changed

Preflight bounded ZIP footer, central-directory bytes and actual entry headers before ZipInfo allocation. Stream TAR extraction and bound cumulative PAX/GNU extended metadata before parsing or format detection; preserve valid ZIP64/PAX inputs, path/link/device protections and existing entry-limit response text.

Acceptance criteria completed

Implementation and targeted regression coverage below. See remaining work for conditions not verified.

Testing performed

17 combined archive-metadata and existing ingestion-budget tests passed on final revision; Ruff passed. Targeted mypy and upload/path coverage passed previously. Full CI first exposed an existing response-message regression, then a new-test message mismatch (each run: 1 failed, 1291 passed); both corrected without weakening the pre-allocation assertion. Final full current-head CI is pending.

Current head: b5af6648664dd297fd3e30669d7599fc9398fd21.

Screenshots

Local screenshots and browser measurements are recorded in the remediation delivery report where applicable. Backend-only changes use contract/regression evidence.

Security and data considerations

Preserves owner scoping, source provenance, sealed graph contracts and historical data. No security gate weakened. Rollback: revert this scoped commit; see issue for migration/deployment implications.

Dependencies and blocked work

Independent dev-based PR unless explicitly stated in the issue. No unmerged changes included.

Scope changes or remaining work

Latest full current-head CI/review pending; metadata bound is not process-level CPU/RSS isolation.

Please review @parthrohit22.

Contributor checklist

• Targets dev; dedicated fork branch from latest dev; issue claimed.

• Scope/evidence recorded; unrelated changes and secrets excluded.

• Targeted validation results reported accurately.

• Required current-head CI and maintainer review complete.

Current-head remediation validation

Head: b5af6648664dd297fd3e30669d7599fc9398fd21.

17 combined archive-metadata and existing ingestion-budget tests passed on final revision; Ruff passed. Targeted mypy and upload/path coverage passed previously. Full CI first exposed an existing response-message regression, then a new-test message mismatch (each run: 1 failed, 1291 passed); both corrected without weakening the pre-allocation assertion. Final full current-head CI is pending.

Final full current-head CI/review pending; metadata bounds do not provide process-level CPU/RSS isolation.

No merge recommendation while current-head CI or required reviews remain unresolved. Baseline dependency audit failures require reviewed integration of #546.

[vercel]

@SHAURYAKSHARMA24 is attempting to deploy a commit to the parthrohit60-3117's projects Team on Vercel.

A member of the Team first needs to authorize it.

[SHAURYAKSHARMA24]

Additional validation

Additional pre-buffer PAX/GNU guard and bounded format detection: 5 archive-specific tests and 7 upload path-safety tests passed; targeted mypy and Ruff passed. No resource-exhaustion test used.
No merge or public deployment performed.