bodgit / sevenzip / 26260177354

75%

push

github

fix: protect against specially crafted archives setting high AES cycles (#448)

* Protect against specially crafted archives setting high AES cycles

add maxCyclesPower to cap the number of cycles.
add tests to validate behavior

Cycles setting comes directly from the archive's AES properties byte
which could be set to something like cycles=62 which would mean 2^62 ≈
4.6×10^18 SHA-256 iterations, which would effectively hang the process.
Standard 7-zip archives use cycles=19 so setting the cap to 24 gives
headroom to the standard while still protecting from a malicious file

* fix: extract repeated string literals to constants to satisfy goconst

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* Revert "fix: extract repeated string literals to constants to satisfy goconst"

This reverts commit 723779e69.

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
Co-authored-by: Matt Dainty <matt@bodgit-n-scarper.com>

4 of 4 new or added lines in 1 file covered. (100.0%)

1852 of 2473 relevant lines covered (74.89%)

0.84 hits per line