[MM-19880] Limit size of file inside Zip archive before JSON parsing for Slack Import (#12514)

* Limit size of files inside Zip archive before JSON parsing for Slack import

* Use specific log message when skipping file in Slack import zip due to size

* Updated max size for slack import

app/slackimport.go

@@ -72,6 +72,8 @@ type SlackPost struct {
 
 var isValidChannelNameCharacters = regexp.MustCompile(`^[a-zA-Z0-9\-_]+$`).MatchString
 
+const SLACK_IMPORT_MAX_FILE_SIZE = 1024 * 1024 * 70
+
 type SlackComment struct {
 	User    string `json:"user"`
 	Comment string `json:"comment"`
@@ -696,6 +698,10 @@ func (a *App) SlackImport(fileData multipart.File, fileSize int64, teamID string
 	posts := make(map[string][]SlackPost)
 	uploads := make(map[string]*zip.File)
 	for _, file := range zipreader.File {
+		if file.UncompressedSize64 > SLACK_IMPORT_MAX_FILE_SIZE {
+			log.WriteString(utils.T("api.slackimport.slack_import.zip.file_too_large", map[string]interface{}{"Filename": file.Name}))
+			continue
+		}
 		reader, err := file.Open()
 		if err != nil {
 			log.WriteString(utils.T("api.slackimport.slack_import.open.app_error", map[string]interface{}{"Filename": file.Name}))

i18n/en.json

@@ -1878,6 +1878,10 @@
     "id": "api.slackimport.slack_import.zip.app_error",
     "translation": "Unable to open the Slack export zip file.\r\n"
   },
+  {
+    "id": "api.slackimport.slack_import.zip.file_too_large",
+    "translation": "{{.Filename}} in zip archive too large to process for Slack import\r\n"
+  },
   {
     "id": "api.status.user_not_found.app_error",
     "translation": "User not found"