From b45e11b28c20d2703f5f6fb6016f757569dd2856 Mon Sep 17 00:00:00 2001
From: Abhisek Datta <abhisek.datta@gmail.com>
Date: Mon, 2 Dec 2019 23:25:34 +0530
Subject: [PATCH] [MM-19880] Limit size of file inside Zip archive before JSON
 parsing for Slack Import (#12514)

* Limit size of files inside Zip archive before JSON parsing for Slack import

* Use specific log message when skipping file in Slack import zip due to size

* Updated max size for slack import
---
 app/slackimport.go | 6 ++++++
 i18n/en.json       | 4 ++++
 2 files changed, 10 insertions(+)

diff --git a/app/slackimport.go b/app/slackimport.go
index 6e066ff445..e2e8fe58dd 100644
--- a/app/slackimport.go
+++ b/app/slackimport.go
@@ -72,6 +72,8 @@ type SlackPost struct {
 
 var isValidChannelNameCharacters = regexp.MustCompile(`^[a-zA-Z0-9\-_]+$`).MatchString
 
+const SLACK_IMPORT_MAX_FILE_SIZE = 1024 * 1024 * 70
+
 type SlackComment struct {
 	User    string `json:"user"`
 	Comment string `json:"comment"`
@@ -696,6 +698,10 @@ func (a *App) SlackImport(fileData multipart.File, fileSize int64, teamID string
 	posts := make(map[string][]SlackPost)
 	uploads := make(map[string]*zip.File)
 	for _, file := range zipreader.File {
+		if file.UncompressedSize64 > SLACK_IMPORT_MAX_FILE_SIZE {
+			log.WriteString(utils.T("api.slackimport.slack_import.zip.file_too_large", map[string]interface{}{"Filename": file.Name}))
+			continue
+		}
 		reader, err := file.Open()
 		if err != nil {
 			log.WriteString(utils.T("api.slackimport.slack_import.open.app_error", map[string]interface{}{"Filename": file.Name}))
diff --git a/i18n/en.json b/i18n/en.json
index f00248d0b4..746809fd32 100644
--- a/i18n/en.json
+++ b/i18n/en.json
@@ -1878,6 +1878,10 @@
     "id": "api.slackimport.slack_import.zip.app_error",
     "translation": "Unable to open the Slack export zip file.\r\n"
   },
+  {
+    "id": "api.slackimport.slack_import.zip.file_too_large",
+    "translation": "{{.Filename}} in zip archive too large to process for Slack import\r\n"
+  },
   {
     "id": "api.status.user_not_found.app_error",
     "translation": "User not found"