kreuzberg 4.2.12 → 4.2.13

data/vendor/kreuzberg/src/extraction/archive/mod.rs

@@ -5,14 +5,17 @@
 //! - ZIP archives
 //! - TAR archives (including compressed TAR.GZ, TAR.BZ2)
 //! - 7Z archives
+//! - GZIP archives
 //!
 //! Each format has its own submodule with specialized extraction logic.
 
+mod gzip;
 mod sevenz;
 mod tar;
 mod zip;
 
 // Re-export all public functions for backward compatibility
+pub use gzip::{decompress_gzip, extract_gzip, extract_gzip_metadata, extract_gzip_text_content};
 pub use sevenz::{extract_7z_metadata, extract_7z_text_content};
 pub use tar::{extract_tar_metadata, extract_tar_text_content};
 pub use zip::{extract_zip_metadata, extract_zip_text_content};
@@ -49,10 +52,15 @@ pub(crate) const TEXT_EXTENSIONS: &[&str] = &[
 #[cfg(test)]
 mod tests {
     use super::*;
+    use crate::extractors::security::SecurityLimits;
     use ::tar::Builder as TarBuilder;
     use ::zip::write::{FileOptions, ZipWriter};
     use std::io::{Cursor, Write};
 
+    fn default_limits() -> SecurityLimits {
+        SecurityLimits::default()
+    }
+
     #[test]
     fn test_extract_zip_metadata() {
         let mut cursor = Cursor::new(Vec::new());
@@ -70,7 +78,7 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let metadata = extract_zip_metadata(&bytes).unwrap();
+        let metadata = extract_zip_metadata(&bytes, &default_limits()).unwrap();
 
         assert_eq!(metadata.format, "ZIP");
         assert_eq!(metadata.file_count, 2);
@@ -102,7 +110,7 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let metadata = extract_tar_metadata(&bytes).unwrap();
+        let metadata = extract_tar_metadata(&bytes, &default_limits()).unwrap();
 
         assert_eq!(metadata.format, "TAR");
         assert_eq!(metadata.file_count, 2);
@@ -127,7 +135,7 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let contents = extract_zip_text_content(&bytes).unwrap();
+        let contents = extract_zip_text_content(&bytes, &default_limits()).unwrap();
 
         assert_eq!(contents.len(), 2);
         assert_eq!(contents.get("test.txt").unwrap(), "Hello, World!");
@@ -158,7 +166,7 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let contents = extract_tar_text_content(&bytes).unwrap();
+        let contents = extract_tar_text_content(&bytes, &default_limits()).unwrap();
 
         assert_eq!(contents.len(), 2);
         assert_eq!(contents.get("test.txt").unwrap(), "Hello, World!");
@@ -168,14 +176,14 @@ mod tests {
     #[test]
     fn test_extract_zip_metadata_invalid() {
         let invalid_bytes = vec![0, 1, 2, 3, 4, 5];
-        let result = extract_zip_metadata(&invalid_bytes);
+        let result = extract_zip_metadata(&invalid_bytes, &default_limits());
         assert!(result.is_err());
     }
 
     #[test]
     fn test_extract_tar_metadata_invalid() {
         let invalid_bytes = vec![0, 1, 2, 3, 4, 5];
-        let result = extract_tar_metadata(&invalid_bytes);
+        let result = extract_tar_metadata(&invalid_bytes, &default_limits());
         assert!(result.is_err());
     }
 
@@ -199,7 +207,7 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let metadata = extract_zip_metadata(&bytes).unwrap();
+        let metadata = extract_zip_metadata(&bytes, &default_limits()).unwrap();
 
         assert_eq!(metadata.format, "ZIP");
         assert_eq!(metadata.file_count, 4);
@@ -233,7 +241,7 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let metadata = extract_tar_metadata(&bytes).unwrap();
+        let metadata = extract_tar_metadata(&bytes, &default_limits()).unwrap();
 
         assert_eq!(metadata.format, "TAR");
         assert_eq!(metadata.file_count, 2);
@@ -258,7 +266,7 @@ mod tests {
             tar.finish().unwrap();
         }
 
-        let metadata = extract_tar_metadata(&tar_data).unwrap();
+        let metadata = extract_tar_metadata(&tar_data, &default_limits()).unwrap();
         assert_eq!(metadata.format, "TAR");
         assert_eq!(metadata.file_count, 1);
         assert_eq!(metadata.file_list[0].path, "test.txt");
@@ -288,7 +296,7 @@ mod tests {
         };
 
         let bytes = cursor.into_inner();
-        let metadata = extract_7z_metadata(&bytes).unwrap();
+        let metadata = extract_7z_metadata(&bytes, &default_limits()).unwrap();
 
         assert_eq!(metadata.format, "7Z");
         assert_eq!(metadata.file_count, 2);
@@ -324,7 +332,7 @@ mod tests {
         }
 
         let outer_bytes = outer_cursor.into_inner();
-        let metadata = extract_zip_metadata(&outer_bytes).unwrap();
+        let metadata = extract_zip_metadata(&outer_bytes, &default_limits()).unwrap();
 
         assert_eq!(metadata.file_count, 2);
 
@@ -371,7 +379,7 @@ mod tests {
         }
 
         let outer_bytes = outer_cursor.into_inner();
-        let metadata = extract_tar_metadata(&outer_bytes).unwrap();
+        let metadata = extract_tar_metadata(&outer_bytes, &default_limits()).unwrap();
 
         assert_eq!(metadata.file_count, 2);
 
@@ -397,7 +405,7 @@ mod tests {
         let mut corrupted = valid_cursor.into_inner();
         corrupted.truncate(corrupted.len() / 2);
 
-        let result = extract_zip_metadata(&corrupted);
+        let result = extract_zip_metadata(&corrupted, &default_limits());
         assert!(result.is_err());
 
         if let Err(e) = result {
@@ -424,7 +432,7 @@ mod tests {
         let mut corrupted = valid_cursor.into_inner();
         corrupted[100] = 0xFF;
 
-        let result = extract_tar_metadata(&corrupted);
+        let result = extract_tar_metadata(&corrupted, &default_limits());
         assert!(result.is_err());
     }
 
@@ -437,7 +445,7 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let metadata = extract_zip_metadata(&bytes).unwrap();
+        let metadata = extract_zip_metadata(&bytes, &default_limits()).unwrap();
 
         assert_eq!(metadata.format, "ZIP");
         assert_eq!(metadata.file_count, 0);
@@ -454,7 +462,7 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let metadata = extract_tar_metadata(&bytes).unwrap();
+        let metadata = extract_tar_metadata(&bytes, &default_limits()).unwrap();
 
         assert_eq!(metadata.format, "TAR");
         assert_eq!(metadata.file_count, 0);
@@ -485,7 +493,7 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let contents = extract_zip_text_content(&bytes).unwrap();
+        let contents = extract_zip_text_content(&bytes, &default_limits()).unwrap();
 
         assert_eq!(contents.len(), 3);
         assert_eq!(contents.get("file1.txt").unwrap(), "Content 1");
@@ -519,7 +527,7 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let contents = extract_tar_text_content(&bytes).unwrap();
+        let contents = extract_tar_text_content(&bytes, &default_limits()).unwrap();
 
         assert_eq!(contents.len(), 4);
         assert_eq!(contents.get("file1.txt").unwrap(), "Content 1");
@@ -552,7 +560,7 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let metadata = extract_zip_metadata(&bytes).unwrap();
+        let metadata = extract_zip_metadata(&bytes, &default_limits()).unwrap();
 
         let paths: Vec<&str> = metadata.file_list.iter().map(|e| e.path.as_str()).collect();
         assert!(paths.contains(&"root/"));
@@ -579,12 +587,12 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let metadata = extract_zip_metadata(&bytes).unwrap();
+        let metadata = extract_zip_metadata(&bytes, &default_limits()).unwrap();
 
         assert_eq!(metadata.file_count, 1);
         assert_eq!(metadata.total_size, 10_000);
 
-        let contents = extract_zip_text_content(&bytes).unwrap();
+        let contents = extract_zip_text_content(&bytes, &default_limits()).unwrap();
         assert_eq!(contents.get("large.txt").unwrap().len(), 10_000);
     }
 
@@ -607,12 +615,12 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let metadata = extract_zip_metadata(&bytes).unwrap();
+        let metadata = extract_zip_metadata(&bytes, &default_limits()).unwrap();
 
         assert_eq!(metadata.file_count, 100);
         assert_eq!(metadata.file_list.len(), 100);
 
-        let contents = extract_zip_text_content(&bytes).unwrap();
+        let contents = extract_zip_text_content(&bytes, &default_limits()).unwrap();
         assert_eq!(contents.len(), 100);
     }
 
@@ -632,12 +640,12 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let metadata = extract_zip_metadata(&bytes).unwrap();
+        let metadata = extract_zip_metadata(&bytes, &default_limits()).unwrap();
 
         assert_eq!(metadata.file_count, 1);
         assert!(metadata.file_list[0].path.len() > 200);
 
-        let contents = extract_zip_text_content(&bytes).unwrap();
+        let contents = extract_zip_text_content(&bytes, &default_limits()).unwrap();
         assert_eq!(contents.len(), 1);
     }
 
@@ -665,7 +673,7 @@ mod tests {
         };
 
         let bytes = cursor.into_inner();
-        let contents = extract_7z_text_content(&bytes).unwrap();
+        let contents = extract_7z_text_content(&bytes, &default_limits()).unwrap();
 
         assert_eq!(contents.len(), 2);
         assert_eq!(contents.get("test.txt").unwrap(), "Hello 7z text!");
@@ -683,7 +691,7 @@ mod tests {
         };
 
         let bytes = cursor.into_inner();
-        let metadata = extract_7z_metadata(&bytes).unwrap();
+        let metadata = extract_7z_metadata(&bytes, &default_limits()).unwrap();
 
         assert_eq!(metadata.format, "7Z");
         assert_eq!(metadata.file_count, 0);
@@ -708,12 +716,12 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let metadata = extract_tar_metadata(&bytes).unwrap();
+        let metadata = extract_tar_metadata(&bytes, &default_limits()).unwrap();
 
         assert_eq!(metadata.file_count, 1);
         assert_eq!(metadata.total_size, 50_000);
 
-        let contents = extract_tar_text_content(&bytes).unwrap();
+        let contents = extract_tar_text_content(&bytes, &default_limits()).unwrap();
         assert_eq!(contents.get("large.txt").unwrap().len(), 50_000);
     }
 
@@ -740,7 +748,7 @@ mod tests {
         }
 
         let bytes = cursor.into_inner();
-        let contents = extract_zip_text_content(&bytes).unwrap();
+        let contents = extract_zip_text_content(&bytes, &default_limits()).unwrap();
 
         assert_eq!(contents.len(), 2);
         assert!(contents.contains_key("document.txt"));
@@ -755,11 +763,119 @@ mod tests {
 
         let invalid_7z_data = vec![0x37, 0x7A, 0xBC, 0xAF, 0x27, 0x1C, 0x00];
 
-        let result = extract_7z_metadata(&invalid_7z_data);
+        let result = extract_7z_metadata(&invalid_7z_data, &default_limits());
         assert!(result.is_err());
 
         if let Err(e) = result {
             assert!(matches!(e, KreuzbergError::Parsing { .. }));
         }
     }
+
+    #[test]
+    fn test_extract_gzip_metadata() {
+        use flate2::Compression;
+        use flate2::write::GzEncoder;
+        use std::io::Write;
+
+        let mut encoder = GzEncoder::new(Vec::new(), Compression::default());
+        encoder.write_all(b"Hello from gzip!").unwrap();
+        let compressed = encoder.finish().unwrap();
+
+        let metadata = extract_gzip_metadata(&compressed, &default_limits()).unwrap();
+        assert_eq!(metadata.format, "GZIP");
+        assert_eq!(metadata.file_count, 1);
+        assert_eq!(metadata.total_size, 16);
+    }
+
+    #[test]
+    fn test_extract_gzip_text_content() {
+        use flate2::Compression;
+        use flate2::write::GzEncoder;
+        use std::io::Write;
+
+        let mut encoder = GzEncoder::new(Vec::new(), Compression::default());
+        encoder.write_all(b"Hello from gzip!").unwrap();
+        let compressed = encoder.finish().unwrap();
+
+        let contents = extract_gzip_text_content(&compressed, &default_limits()).unwrap();
+        assert_eq!(contents.len(), 1);
+        assert!(contents.values().next().unwrap().contains("Hello from gzip!"));
+    }
+
+    #[test]
+    fn test_decompress_gzip() {
+        use flate2::Compression;
+        use flate2::write::GzEncoder;
+        use std::io::Write;
+
+        let mut encoder = GzEncoder::new(Vec::new(), Compression::default());
+        encoder.write_all(b"test content").unwrap();
+        let compressed = encoder.finish().unwrap();
+
+        let decompressed = decompress_gzip(&compressed, &default_limits()).unwrap();
+        assert_eq!(String::from_utf8(decompressed).unwrap(), "test content");
+    }
+
+    #[test]
+    fn test_extract_gzip_invalid_data() {
+        let invalid = vec![0, 1, 2, 3, 4, 5];
+        let result = extract_gzip_metadata(&invalid, &default_limits());
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_extract_gzip_empty_content() {
+        use flate2::Compression;
+        use flate2::write::GzEncoder;
+
+        let encoder = GzEncoder::new(Vec::new(), Compression::default());
+        let compressed = encoder.finish().unwrap();
+
+        let metadata = extract_gzip_metadata(&compressed, &default_limits()).unwrap();
+        assert_eq!(metadata.format, "GZIP");
+        assert_eq!(metadata.total_size, 0);
+    }
+
+    #[test]
+    fn test_zip_too_many_files_rejected() {
+        let mut cursor = Cursor::new(Vec::new());
+        {
+            let mut zip = ZipWriter::new(&mut cursor);
+            let options = FileOptions::<'_, ()>::default();
+
+            for i in 0..5 {
+                let filename = format!("file_{}.txt", i);
+                zip.start_file(&filename, options).unwrap();
+                zip.write_all(b"content").unwrap();
+            }
+            zip.finish().unwrap();
+        }
+
+        let bytes = cursor.into_inner();
+        let limits = SecurityLimits {
+            max_files_in_archive: 3,
+            ..SecurityLimits::default()
+        };
+        let result = extract_zip_metadata(&bytes, &limits);
+        assert!(result.is_err());
+    }
+
+    #[test]
+    fn test_gzip_bomb_rejected() {
+        use flate2::Compression;
+        use flate2::write::GzEncoder;
+        use std::io::Write;
+
+        // Create data that exceeds a tiny limit
+        let mut encoder = GzEncoder::new(Vec::new(), Compression::default());
+        encoder.write_all(&[b'A'; 1024]).unwrap();
+        let compressed = encoder.finish().unwrap();
+
+        let limits = SecurityLimits {
+            max_archive_size: 100, // 100 bytes limit
+            ..SecurityLimits::default()
+        };
+        let result = extract_gzip_metadata(&compressed, &limits);
+        assert!(result.is_err());
+    }
 }

data/vendor/kreuzberg/src/extraction/archive/sevenz.rs

@@ -4,6 +4,7 @@
 
 use super::{ArchiveEntry, ArchiveMetadata, TEXT_EXTENSIONS};
 use crate::error::{KreuzbergError, Result};
+use crate::extractors::security::SecurityLimits;
 use sevenz_rust2::{ArchiveReader, Password};
 use std::collections::HashMap;
 use std::io::Cursor;
@@ -13,6 +14,7 @@ use std::io::Cursor;
 /// # Arguments
 ///
 /// * `bytes` - The 7z archive bytes
+/// * `limits` - Security limits for archive extraction
 ///
 /// # Returns
 ///
@@ -24,8 +26,9 @@ use std::io::Cursor;
 ///
 /// # Errors
 ///
-/// Returns an error if the 7z archive cannot be read or parsed.
-pub fn extract_7z_metadata(bytes: &[u8]) -> Result<ArchiveMetadata> {
+/// Returns an error if the 7z archive cannot be read or parsed,
+/// or if security limits are exceeded.
+pub fn extract_7z_metadata(bytes: &[u8], limits: &SecurityLimits) -> Result<ArchiveMetadata> {
     let cursor = Cursor::new(bytes);
     let archive = ArchiveReader::new(cursor, Password::empty())
         .map_err(|e| KreuzbergError::parsing(format!("Failed to read 7z archive: {}", e)))?;
@@ -33,7 +36,16 @@ pub fn extract_7z_metadata(bytes: &[u8]) -> Result<ArchiveMetadata> {
     let mut file_list = Vec::new();
     let mut total_size = 0u64;
 
-    for entry in &archive.archive().files {
+    let files = &archive.archive().files;
+    if files.len() > limits.max_files_in_archive {
+        return Err(KreuzbergError::validation(format!(
+            "7z archive has too many files: {} (max: {})",
+            files.len(),
+            limits.max_files_in_archive
+        )));
+    }
+
+    for entry in files {
         let path = entry.name().to_string();
         let size = entry.size();
         let is_dir = entry.is_directory();
@@ -42,6 +54,13 @@ pub fn extract_7z_metadata(bytes: &[u8]) -> Result<ArchiveMetadata> {
             total_size += size;
         }
 
+        if total_size > limits.max_archive_size as u64 {
+            return Err(KreuzbergError::validation(format!(
+                "7z archive total uncompressed size exceeds limit: {} bytes (max: {} bytes)",
+                total_size, limits.max_archive_size
+            )));
+        }
+
         file_list.push(ArchiveEntry { path, size, is_dir });
     }
 
@@ -71,12 +90,22 @@ pub fn extract_7z_metadata(bytes: &[u8]) -> Result<ArchiveMetadata> {
 /// # Errors
 ///
 /// Returns an error if the 7z archive cannot be read or parsed.
-pub fn extract_7z_text_content(bytes: &[u8]) -> Result<HashMap<String, String>> {
+pub fn extract_7z_text_content(bytes: &[u8], limits: &SecurityLimits) -> Result<HashMap<String, String>> {
     let cursor = Cursor::new(bytes);
     let mut archive = ArchiveReader::new(cursor, Password::empty())
         .map_err(|e| KreuzbergError::parsing(format!("Failed to read 7z archive: {}", e)))?;
 
+    let file_count = archive.archive().files.len();
+    if file_count > limits.max_files_in_archive {
+        return Err(KreuzbergError::validation(format!(
+            "7z archive has too many files: {} (max: {})",
+            file_count, limits.max_files_in_archive
+        )));
+    }
+
     let mut contents = HashMap::new();
+    let max_content_size = limits.max_content_size;
+    let mut total_content_size = 0usize;
 
     archive
         .for_each_entries(|entry, reader| {
@@ -87,6 +116,10 @@ pub fn extract_7z_text_content(bytes: &[u8]) -> Result<HashMap<String, String>>
                 if let Ok(_) = reader.read_to_end(&mut content)
                     && let Ok(text) = String::from_utf8(content)
                 {
+                    total_content_size = total_content_size.saturating_add(text.len());
+                    if total_content_size > max_content_size {
+                        return Ok(false);
+                    }
                     contents.insert(path, text);
                 }
             }
@@ -94,5 +127,12 @@ pub fn extract_7z_text_content(bytes: &[u8]) -> Result<HashMap<String, String>>
         })
         .map_err(|e| KreuzbergError::parsing(format!("Failed to read 7z entries: {}", e)))?;
 
+    if total_content_size > max_content_size {
+        return Err(KreuzbergError::validation(format!(
+            "7z archive text content exceeds limit: {} bytes (max: {} bytes)",
+            total_content_size, max_content_size
+        )));
+    }
+
     Ok(contents)
 }

data/vendor/kreuzberg/src/extraction/archive/tar.rs

@@ -5,6 +5,7 @@
 
 use super::{ArchiveEntry, ArchiveMetadata, TEXT_EXTENSIONS};
 use crate::error::{KreuzbergError, Result};
+use crate::extractors::security::SecurityLimits;
 use std::collections::HashMap;
 use std::io::{Cursor, Read};
 use tar::Archive as TarArchive;
@@ -14,6 +15,7 @@ use tar::Archive as TarArchive;
 /// # Arguments
 ///
 /// * `bytes` - The TAR archive bytes (can be compressed with gzip or bzip2)
+/// * `limits` - Security limits for archive extraction
 ///
 /// # Returns
 ///
@@ -25,8 +27,9 @@ use tar::Archive as TarArchive;
 ///
 /// # Errors
 ///
-/// Returns an error if the TAR archive cannot be read or parsed.
-pub fn extract_tar_metadata(bytes: &[u8]) -> Result<ArchiveMetadata> {
+/// Returns an error if the TAR archive cannot be read or parsed,
+/// or if security limits are exceeded.
+pub fn extract_tar_metadata(bytes: &[u8], limits: &SecurityLimits) -> Result<ArchiveMetadata> {
     let cursor = Cursor::new(bytes);
     let mut archive = TarArchive::new(cursor);
 
@@ -56,6 +59,21 @@ pub fn extract_tar_metadata(bytes: &[u8]) -> Result<ArchiveMetadata> {
         }
 
         file_count += 1;
+
+        if file_count > limits.max_files_in_archive {
+            return Err(KreuzbergError::validation(format!(
+                "TAR archive has too many files: {} (max: {})",
+                file_count, limits.max_files_in_archive
+            )));
+        }
+
+        if total_size > limits.max_archive_size as u64 {
+            return Err(KreuzbergError::validation(format!(
+                "TAR archive total uncompressed size exceeds limit: {} bytes (max: {} bytes)",
+                total_size, limits.max_archive_size
+            )));
+        }
+
         file_list.push(ArchiveEntry { path, size, is_dir });
     }
 
@@ -83,12 +101,14 @@ pub fn extract_tar_metadata(bytes: &[u8]) -> Result<ArchiveMetadata> {
 /// # Errors
 ///
 /// Returns an error if the TAR archive cannot be read or parsed.
-pub fn extract_tar_text_content(bytes: &[u8]) -> Result<HashMap<String, String>> {
+pub fn extract_tar_text_content(bytes: &[u8], limits: &SecurityLimits) -> Result<HashMap<String, String>> {
     let cursor = Cursor::new(bytes);
     let mut archive = TarArchive::new(cursor);
 
     let estimated_text_files = bytes.len().saturating_div(1024 * 10).min(100);
     let mut contents = HashMap::with_capacity(estimated_text_files.max(2));
+    let mut file_count = 0usize;
+    let mut total_content_size = 0usize;
 
     let entries = archive
         .entries()
@@ -98,6 +118,14 @@ pub fn extract_tar_text_content(bytes: &[u8]) -> Result<HashMap<String, String>>
         let mut entry =
             entry_result.map_err(|e| KreuzbergError::parsing(format!("Failed to read TAR entry: {}", e)))?;
 
+        file_count += 1;
+        if file_count > limits.max_files_in_archive {
+            return Err(KreuzbergError::validation(format!(
+                "TAR archive has too many files: {} (max: {})",
+                file_count, limits.max_files_in_archive
+            )));
+        }
+
         let path = entry
             .path()
             .map_err(|e| KreuzbergError::parsing(format!("Failed to read TAR entry path: {}", e)))?
@@ -109,6 +137,13 @@ pub fn extract_tar_text_content(bytes: &[u8]) -> Result<HashMap<String, String>>
             let estimated_size = (entry.size().min(10 * 1024 * 1024)) as usize;
             let mut content = String::with_capacity(estimated_size);
             if entry.read_to_string(&mut content).is_ok() {
+                total_content_size = total_content_size.saturating_add(content.len());
+                if total_content_size > limits.max_content_size {
+                    return Err(KreuzbergError::validation(format!(
+                        "TAR archive text content exceeds limit: {} bytes (max: {} bytes)",
+                        total_content_size, limits.max_content_size
+                    )));
+                }
                 contents.insert(path, content);
             }
         }

data/vendor/kreuzberg/src/extraction/archive/zip.rs

@@ -4,6 +4,7 @@
 
 use super::{ArchiveEntry, ArchiveMetadata, TEXT_EXTENSIONS};
 use crate::error::{KreuzbergError, Result};
+use crate::extractors::security::SecurityLimits;
 use std::collections::HashMap;
 use std::io::{Cursor, Read};
 use zip::ZipArchive;
@@ -13,6 +14,7 @@ use zip::ZipArchive;
 /// # Arguments
 ///
 /// * `bytes` - The ZIP archive bytes
+/// * `limits` - Security limits for archive extraction
 ///
 /// # Returns
 ///
@@ -24,12 +26,21 @@ use zip::ZipArchive;
 ///
 /// # Errors
 ///
-/// Returns an error if the ZIP archive cannot be read or parsed.
-pub fn extract_zip_metadata(bytes: &[u8]) -> Result<ArchiveMetadata> {
+/// Returns an error if the ZIP archive cannot be read or parsed,
+/// or if security limits are exceeded.
+pub fn extract_zip_metadata(bytes: &[u8], limits: &SecurityLimits) -> Result<ArchiveMetadata> {
     let cursor = Cursor::new(bytes);
     let mut archive =
         ZipArchive::new(cursor).map_err(|e| KreuzbergError::parsing(format!("Failed to read ZIP archive: {}", e)))?;
 
+    if archive.len() > limits.max_files_in_archive {
+        return Err(KreuzbergError::validation(format!(
+            "ZIP archive has too many files: {} (max: {})",
+            archive.len(),
+            limits.max_files_in_archive
+        )));
+    }
+
     let mut file_list = Vec::with_capacity(archive.len());
     let mut total_size = 0u64;
 
@@ -46,6 +57,13 @@ pub fn extract_zip_metadata(bytes: &[u8]) -> Result<ArchiveMetadata> {
             total_size += size;
         }
 
+        if total_size > limits.max_archive_size as u64 {
+            return Err(KreuzbergError::validation(format!(
+                "ZIP archive total uncompressed size exceeds limit: {} bytes (max: {} bytes)",
+                total_size, limits.max_archive_size
+            )));
+        }
+
         file_list.push(ArchiveEntry { path, size, is_dir });
     }
 
@@ -73,13 +91,22 @@ pub fn extract_zip_metadata(bytes: &[u8]) -> Result<ArchiveMetadata> {
 /// # Errors
 ///
 /// Returns an error if the ZIP archive cannot be read or parsed.
-pub fn extract_zip_text_content(bytes: &[u8]) -> Result<HashMap<String, String>> {
+pub fn extract_zip_text_content(bytes: &[u8], limits: &SecurityLimits) -> Result<HashMap<String, String>> {
     let cursor = Cursor::new(bytes);
     let mut archive =
         ZipArchive::new(cursor).map_err(|e| KreuzbergError::parsing(format!("Failed to read ZIP archive: {}", e)))?;
 
+    if archive.len() > limits.max_files_in_archive {
+        return Err(KreuzbergError::validation(format!(
+            "ZIP archive has too many files: {} (max: {})",
+            archive.len(),
+            limits.max_files_in_archive
+        )));
+    }
+
     let estimated_text_files = archive.len().saturating_mul(3).saturating_div(10).max(2);
     let mut contents = HashMap::with_capacity(estimated_text_files);
+    let mut total_content_size = 0usize;
 
     for i in 0..archive.len() {
         let mut file = archive
@@ -92,6 +119,13 @@ pub fn extract_zip_text_content(bytes: &[u8]) -> Result<HashMap<String, String>>
             let estimated_size = (file.size() as usize).min(10 * 1024 * 1024);
             let mut content = String::with_capacity(estimated_size);
             if file.read_to_string(&mut content).is_ok() {
+                total_content_size = total_content_size.saturating_add(content.len());
+                if total_content_size > limits.max_content_size {
+                    return Err(KreuzbergError::validation(format!(
+                        "ZIP archive text content exceeds limit: {} bytes (max: {} bytes)",
+                        total_content_size, limits.max_content_size
+                    )));
+                }
                 contents.insert(path, content);
             }
         }