ref(download): Use download service for objectstore requests - #1928
ref(download): Use download service for objectstore requests#1928jjbayer wants to merge 9 commits into
1 issue
wrdn-dos-review: Found 1 issue (1 medium)
Medium
Remote minidump attachment decompression has no effective CPU bound despite 15GiB output cap - `crates/symbolicator-native/src/symbolication/attachments.rs:31-36`
An attacker-controlled storage URL can serve a tiny zstd/gzip/zlib/zip/CAB payload that fetch_file synchronously inflates into a temporary file after the download timeout has ended. Although output is capped at the default 15GiB, the decompression and subsequent minidump processing have no decompression-specific CPU budget; the outer request timeout cannot preempt this synchronous block, allowing substantial CPU and disk exhaustion on the shared worker pool.
⏱ 3m 6s · 939.3k in / 30.4k out · $0.62
Annotations
Check warning on line 36 in crates/symbolicator-native/src/symbolication/attachments.rs
sentry-warden / warden: wrdn-dos-review
Remote minidump attachment decompression has no effective CPU bound despite 15GiB output cap
An attacker-controlled storage URL can serve a tiny zstd/gzip/zlib/zip/CAB payload that `fetch_file` synchronously inflates into a temporary file after the download timeout has ended. Although output is capped at the default 15GiB, the decompression and subsequent minidump processing have no decompression-specific CPU budget; the outer request timeout cannot preempt this synchronous block, allowing substantial CPU and disk exhaustion on the shared worker pool.