Add max size for config files

pkg/db/dump.go

@@ -41,6 +41,7 @@ func Dump() (data map[string][]byte, err error) {
 	return
 }
 
+// Restore restores a table with all its entries
 func Restore(table string, contents []map[string]interface{}) (err error) {
 
 	for _, content := range contents {

pkg/modules/dump/restore.go

@@ -35,6 +35,8 @@ import (
 	"strings"
 )
 
+const maxConfigSize = 5 * 1024 * 1024 // 5 MB, should be largely enough
+
 // Restore takes a zip file name and restores it
 func Restore(filename string) error {
 
@@ -78,10 +80,30 @@ func Restore(filename string) error {
 
 	///////
 	// Restore the config file
-	if err := writeFile(configFile, configFile.Name); err != nil {
+	if configFile.UncompressedSize64 > maxConfigSize {
+		return fmt.Errorf("config file too large, is %d, max size is %d", configFile.UncompressedSize64, maxConfigSize)
+	}
+
+	outFile, err := os.OpenFile(configFile.Name, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, configFile.Mode())
+	if err != nil {
+		return fmt.Errorf("could not open config file for writing: %s", err)
+	}
+
+	cfgr, err := configFile.Open()
+	if err != nil {
+		return err
+	}
+
+	// #nosec - We eliminated the potential decompression bomb by erroring out above if the file is larger than a threshold.
+	_, err = io.Copy(outFile, cfgr)
+	if err != nil {
 		return fmt.Errorf("could not create config file: %s", err)
 	}
-	log.Info("Restored configFile file.")
+
+	_ = cfgr.Close()
+	_ = outFile.Close()
+
+	log.Info("Restored config file.")
 
 	// Init the configFile again since the restored configuration is most likely different from the one before
 	initialize.LightInit()
@@ -125,7 +147,7 @@ func Restore(filename string) error {
 
 	// Restore all db data
 	for table, d := range dbfiles {
-		content, err := unmarshalFileToJson(d)
+		content, err := unmarshalFileToJSON(d)
 		if err != nil {
 			return fmt.Errorf("could not read table %s: %s", table, err)
 		}
@@ -170,25 +192,7 @@ func Restore(filename string) error {
 	return nil
 }
 
-func writeFile(file *zip.File, path string) error {
-
-	outFile, err := os.OpenFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, file.Mode())
-	if err != nil {
-		return err
-	}
-	defer outFile.Close()
-
-	rc, err := file.Open()
-	if err != nil {
-		return err
-	}
-	defer rc.Close()
-
-	_, err = io.Copy(outFile, rc)
-	return err
-}
-
-func unmarshalFileToJson(file *zip.File) (contents []map[string]interface{}, err error) {
+func unmarshalFileToJSON(file *zip.File) (contents []map[string]interface{}, err error) {
 	rc, err := file.Open()
 	if err != nil {
 		return