Validate size in the DagReaders
Open
status/in-progress
topic/security
- Dominant language
- Go
- Stars
- 17.1k
- Forks
- 3.2k
- Avg merge
- 3d 18h
- Merged PRs (30d)
- 11
Description
When reading files, we should always validate the size (it doesn't look like it currently does). If we ever hit a chunk that's too large, we should truncate it. If we ever hit a chunk that's too small, we should return zeros (allowing holes in files is actually quite useful). We should also document this in a spec somewhere.
Expected size not matching the actual size of something tends to lead to security problems...
@diasdavid objections? How does js-ipfs deal with this issue?
Contributor guide
Assessment
This issue has not been assessed yet.