pub fn unzip_bundle_import(
zip_bytes: &[u8],
) -> Result<(Vec<BundleImportFile>, Vec<String>), String>Expand description
Unpack a .abf zip archive into a flat file list, applying the same
path-safety check as everywhere else in this module to every entry
name before it’s trusted (§4.3.4) — a zip’s own internal paths are
exactly as untrusted as any other part of the archive’s content.
Directory entries are skipped; anything that fails the safety check is
dropped with a warning rather than surfaced as a file.
Codex P1, PR #2379: also bounds decompressed size, per-entry and in
aggregate — read_to_string alone has no size limit, so an untrusted
.abf containing a highly compressed entry (a classic zip-bomb shape;
DEFLATE alone permits ratios past 1000:1) could otherwise exhaust the
server process’s memory through bundle.import. An oversized single
entry is skipped with a warning (matches this function’s existing
per-entry-problem philosophy); an oversized AGGREGATE fails the whole
import — letting a partially-capped import through silently would be
more confusing than useful, and hitting the aggregate cap at all
already indicates a genuinely abusive archive rather than one bad file.