Skip to content

SURF-1403: APOC security issue; Archive entry fully decompressed into memory before size limit is applied - #965

Merged
gem-neo4j merged 1 commit into
devfrom
surf-1403
Sep 8, 2026
Merged

gem-neo4j merged 1 commit into
devfrom
surf-1403

Conversation

@gem-neo4j

Copy link
Copy Markdown
Contributor

Moved the LimitedSizeInputStream wrap to bound bytes as they're read from the archive entry itself, before IOUtils.toByteArray runs (see card for recommended fix for more details)

@JoelBergstrand JoelBergstrand left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

So was the logic there already just in the wrong ordered?

@gem-neo4j

Copy link
Copy Markdown
Contributor Author

@JoelBergstrand wrongly ordered for one use case, it worked for other use cases (hence the other tests in the file), but yeah, pretty much :P

@gem-neo4j
gem-neo4j merged commit eddcace into dev Sep 8, 2026
7 checks passed
@gem-neo4j
gem-neo4j deleted the surf-1403 branch September 8, 2026 13:32
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants