Prevent decompression bomb

문서 > 코드 분석 > Static Analysis Rules > Prevent decompression bomb

이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.

Metadata

ID: go-security/decompression-bomb

Language: Go

Severity: Warning

Category: Security

CWE: 409

Description

Reading continuously from a compressed file without any limit of bytes may read too much data and lead to a denial of service (DoS). Prefer reading data by chunks of bytes.

Learn More

Non-Compliant Code Examples

package main

import (
	"bytes"
	"compress/bzip2"
	"io"
	"os"
)

func main() {
	buff := []byte{42, 51}
	b := bytes.NewReader(buff)

	r, err := zlib.NewReader(b)
	if err != nil {
		panic(err)
	}
	_, err = io.CopyBuffer(os.Stdout, r)
	if err != nil {
		panic(err)
	}

	r.Close()
}

package main

import (
	"bytes"
	"compress/zlib"
	"io"
	"os"
)

func main() {
	buff := []byte{42, 51}
	b := bytes.NewReader(buff)

	r, err := zlib.NewReader(b)
	if err != nil {
		panic(err)
	}
	_, err = io.Copy(os.Stdout, r)
	if err != nil {
		panic(err)
	}

	r.Close()
}

Compliant Code Examples

package main

import (
	"bytes"
	"compress/bzip2"
	"io"
	"os"
)

func main() {
	buff := []byte{42, 51}
	b := bytes.NewReader(buff)

	r, err := zlib.NewReader(b)
	if err != nil {
		panic(err)
	}
	_, err = io.CopyN(os.Stdout, r, 64)
	if err != nil {
		panic(err)
	}

	r.Close()
}