fix(file-parsers): verify actual inflation, not just declared ZIP sizes

The declared uncompressed sizes in a ZIP central directory are attacker-
controlled, so a bomb can under-report them and pass the size and ratio
checks untouched. officeparser and mammoth only detect the mismatch after
inflating the entry in full: a 498 KB archive declaring 1000 bytes per entry
drove 559 MB resident through the .doc parser and 538 MB through .docx, then
failed. SheetJS and officeparser reject the container earlier, so xlsx/pptx
were not affected, but doc and docx both were.

Each entry is now inflated during verification under a maxOutputLength bound
equal to the size it declared. Node's zlib aborts the moment output would
exceed that bound, so a lying entry costs only its declared size and the
inflated bytes are discarded immediately; both bomb variants now reject at
+0 MB across every extension. Stored entries are checked against their own
compressed size, and unsupported compression methods fail closed.

Verification walks the contiguous run of central-directory records rather
than the EOCD's declared entry count, since that run is what a decompression
library allocates per entry — a lied-down count must not hide an entry from
verification.

Cost is ~0.45 ms per MB of uncompressed content (22 ms for a 50 MB archive),
against parse times an order of magnitude larger. All 17 real Word-produced
.docx fixtures in mammoth's test data are still accepted.

Author: waleedlatif1

apps/sim/lib/file-parsers/doc-parser.test.ts

@@ -64,6 +64,32 @@ describe('DocParser.parseBuffer', () => {
     expect(mockExtractRawText).not.toHaveBeenCalled()
   })
 
+  it('rejects a .doc that under-declares its uncompressed size', async () => {
+    // Declared sizes alone put this under every limit; officeparser and mammoth
+    // only notice the mismatch after inflating the entry in full, so the guard
+    // has to catch it before either library sees the buffer.
+    const zip = new JSZip()
+    zip.file('word/document.xml', 'A'.repeat(4 * 1024 * 1024))
+    const honest = (await zip.generateAsync({
+      type: 'nodebuffer',
+      compression: 'DEFLATE',
+    })) as Buffer
+
+    const lying = Buffer.from(honest)
+    for (let offset = 0; offset + 30 <= lying.length; offset++) {
+      const signature = lying.readUInt32LE(offset)
+      if (signature === CENTRAL_DIRECTORY_HEADER_SIGNATURE) {
+        lying.writeUInt32LE(1000, offset + 24)
+      } else if (signature === 0x04034b50) {
+        lying.writeUInt32LE(1000, offset + 22)
+      }
+    }
+
+    await expect(new DocParser().parseBuffer(lying)).rejects.toThrow(/do not match declared sizes/)
+    expect(mockParseOfficeAsync).not.toHaveBeenCalled()
+    expect(mockExtractRawText).not.toHaveBeenCalled()
+  })
+
   it('rejects a ZIP-shaped .doc whose central directory cannot be parsed', async () => {
     const buffer = Buffer.alloc(64)
     buffer.writeUInt32LE(0x04034b50, 0)

apps/sim/lib/file-parsers/zip-guard.test.ts

@@ -30,6 +30,47 @@ async function buildZip(
   })
 }
 
+const CENTRAL_DIRECTORY_HEADER_SIGNATURE = 0x02014b50
+const LOCAL_FILE_HEADER_SIGNATURE = 0x04034b50
+
+/**
+ * Rewrite every declared uncompressed size — in both the central directory and
+ * the local file headers — so the archive under-reports how much it expands to.
+ * This is the bypass a declared-size-only check cannot see. Zero-length records
+ * (JSZip emits a stored directory entry per folder) are left alone so the
+ * archive stays well-formed apart from the lie under test.
+ */
+function underDeclareSizes(source: Buffer, declared: number): Buffer {
+  const buffer = Buffer.from(source)
+  for (let offset = 0; offset + 30 <= buffer.length; offset++) {
+    const signature = buffer.readUInt32LE(offset)
+    if (signature === CENTRAL_DIRECTORY_HEADER_SIGNATURE) {
+      if (buffer.readUInt32LE(offset + 24) !== 0) {
+        buffer.writeUInt32LE(declared, offset + 24)
+      }
+    } else if (signature === LOCAL_FILE_HEADER_SIGNATURE) {
+      if (buffer.readUInt32LE(offset + 22) !== 0) {
+        buffer.writeUInt32LE(declared, offset + 22)
+      }
+    }
+  }
+  return buffer
+}
+
+/** Overwrite the compression method on every non-empty central-directory record. */
+function setCompressionMethod(source: Buffer, method: number): Buffer {
+  const buffer = Buffer.from(source)
+  for (let offset = 0; offset + 46 <= buffer.length; offset++) {
+    if (
+      buffer.readUInt32LE(offset) === CENTRAL_DIRECTORY_HEADER_SIGNATURE &&
+      buffer.readUInt32LE(offset + 24) !== 0
+    ) {
+      buffer.writeUInt16LE(method, offset + 10)
+    }
+  }
+  return buffer
+}
+
 describe('assertOoxmlArchiveWithinLimits', () => {
   it('accepts a well-formed archive within limits', async () => {
     const buffer = await buildZip({ 'word/document.xml': '<xml>hello world</xml>' })
@@ -108,6 +149,53 @@ describe('assertOoxmlArchiveWithinLimits', () => {
     expect(() => assertOoxmlArchiveWithinLimits(tampered)).toThrow(ZipBombError)
   })
 
+  it('rejects an archive that under-declares its uncompressed size', async () => {
+    // The declared sizes put this archive far under both limits, so only
+    // inflating it reveals that it actually expands ~200x further.
+    const honest = await buildZip({ 'word/document.xml': 'A'.repeat(200_000) })
+    const lying = underDeclareSizes(honest, 1000)
+
+    expect(() => assertOoxmlArchiveWithinLimits(lying, HIGH_LIMITS)).toThrow(ZipBombError)
+    expect(() => assertOoxmlArchiveWithinLimits(lying, HIGH_LIMITS)).toThrow(
+      /inflates beyond the 1000 bytes it declares/
+    )
+  })
+
+  it('still accepts the same archive when its declared sizes are honest', async () => {
+    const honest = await buildZip({ 'word/document.xml': 'A'.repeat(200_000) })
+    expect(() => assertOoxmlArchiveWithinLimits(honest, HIGH_LIMITS)).not.toThrow()
+  })
+
+  it('rejects a stored entry whose declared size does not match its payload', async () => {
+    const zip = new JSZip()
+    zip.file('document.xml', 'A'.repeat(50_000))
+    const stored = (await zip.generateAsync({
+      type: 'nodebuffer',
+      compression: 'STORE',
+    })) as Buffer
+
+    expect(() =>
+      assertOoxmlArchiveWithinLimits(underDeclareSizes(stored, 10), HIGH_LIMITS)
+    ).toThrow(/stored entry declares 10 bytes but holds 50000/)
+  })
+
+  it('rejects an entry using a compression method the parsers cannot read', async () => {
+    const buffer = await buildZip({ 'word/document.xml': '<xml>hello</xml>' })
+    expect(() =>
+      assertOoxmlArchiveWithinLimits(setCompressionMethod(buffer, 12), HIGH_LIMITS)
+    ).toThrow(/unsupported compression method 12/)
+  })
+
+  it('accepts a multi-entry archive whose entries all inflate to what they declare', async () => {
+    const buffer = await buildZip({
+      '[Content_Types].xml': '<?xml version="1.0"?><Types/>',
+      '_rels/.rels': '<?xml version="1.0"?><Relationships/>',
+      'word/document.xml': `<w:document>${'text '.repeat(5000)}</w:document>`,
+      'word/styles.xml': `<w:styles>${'style '.repeat(2000)}</w:styles>`,
+    })
+    expect(() => assertOoxmlArchiveWithinLimits(buffer, HIGH_LIMITS)).not.toThrow()
+  })
+
   it('no-ops for buffers that are not ZIP archives', () => {
     const plaintext = Buffer.from('this is just plain text, not a zip archive at all')
     expect(() => assertOoxmlArchiveWithinLimits(plaintext)).not.toThrow()