module

CrImage::DecompressionGuard

DecompressionGuard provides protection against decompression bombs (also known as zip bombs or compression bombs).

A decompression bomb is a maliciously crafted compressed file that expands to an enormous size when decompressed, potentially exhausting system memory and causing denial of service.

This module tracks compressed vs decompressed data ratios and enforces configurable limits to prevent such attacks.

Constants

DEFAULT_MAX_DECOMPRESSED_SIZE = 500000000_i64

Maximum total decompressed size (500MB by default) This is separate from InputValidation's pixel area limit

DEFAULT_MAX_EXPANSION_RATIO = 1000_i64

Default maximum expansion ratio (compressed:decompressed) A 1KB compressed file can expand to at most 1000KB (1MB)

MIN_COMPRESSED_SIZE_FOR_CHECK = 1024_i64

Minimum compressed size to start checking ratio (1KB) Files smaller than this are exempt from ratio checks

Class methods

create(format : String, config : Config | Nil = nil) : Guard

Create a new guard for a specific format

Source
default_config

Get the default configuration

Source
default_config=(config : Config)

Set the default configuration

Source
track_compressed(io : IO, guard : Guard) : TrackingIO

Wrap an IO to track compressed bytes read

Source
track_decompressed(io : IO, guard : Guard) : TrackingIO

Wrap an IO to track decompressed bytes written

Source

Nested types