NomanProdhan comments

Repositories
Issues
Comments

Results 3 comments of


                                            NomanProdhan

DoS: WireFileTools::unzip() extracts archives before validation with no size/entry limits → lang-edit user can trigger GB-scale expansion

@ryancramerdesign Thanks for the response. I’d like to clarify a few important points about impact and feasible fixes: ### 1. Not Admin-Only This behavior is not restricted to full administrators....

DoS: WireFileTools::unzip() extracts archives before validation with no size/entry limits → lang-edit user can trigger GB-scale expansion

Thanks for the clarification and background on how ProcessWire’s admin environment is intended to be used. I understand your point that the admin is designed for fully trusted users, and...

DoS: WireFileTools::unzip() extracts archives before validation with no size/entry limits → lang-edit user can trigger GB-scale expansion

The module looks solid and it has eliminated the DoS issue.