fix(file-parsers): require central and local ZIP headers to agree

The parsers disagree about which header to trust. JSZip skips the local
header outright and decompresses using the central directory's method, while
SheetJS's parse_local_file switches on the local header's method and inflates
from there. An entry claiming STORED centrally and DEFLATE locally therefore
took the guard's stored branch, skipping bounded inflation, and was still
expanded downstream — a 398 KB archive hiding a 400 MB deflate payload.

Verification now rejects any entry whose two headers disagree on compression
method, and on declared sizes when the local header carries them (the
data-descriptor flag and ZIP64 sentinels legitimately omit them, and those
entries stay covered by the bounded inflate).

Caught by Greptile review. All 17 real Word-produced .docx fixtures in
mammoth's test data are still accepted.

Author: waleedlatif1

apps/sim/lib/file-parsers/zip-guard.test.ts

@@ -57,15 +57,31 @@ function underDeclareSizes(source: Buffer, declared: number): Buffer {
   return buffer
 }
 
-/** Overwrite the compression method on every non-empty central-directory record. */
-function setCompressionMethod(source: Buffer, method: number): Buffer {
+/**
+ * Overwrite the compression method on every non-empty record. `where` selects
+ * which header is rewritten, so a test can make the two disagree — JSZip trusts
+ * the central method while SheetJS switches on the local one.
+ */
+function setCompressionMethod(
+  source: Buffer,
+  method: number,
+  where: 'central' | 'local' | 'both' = 'both'
+): Buffer {
   const buffer = Buffer.from(source)
   for (let offset = 0; offset + 46 <= buffer.length; offset++) {
+    const signature = buffer.readUInt32LE(offset)
     if (
-      buffer.readUInt32LE(offset) === CENTRAL_DIRECTORY_HEADER_SIGNATURE &&
-      buffer.readUInt32LE(offset + 24) !== 0
+      signature === CENTRAL_DIRECTORY_HEADER_SIGNATURE &&
+      buffer.readUInt32LE(offset + 24) !== 0 &&
+      where !== 'local'
     ) {
       buffer.writeUInt16LE(method, offset + 10)
+    } else if (
+      signature === LOCAL_FILE_HEADER_SIGNATURE &&
+      buffer.readUInt32LE(offset + 22) !== 0 &&
+      where !== 'central'
+    ) {
+      buffer.writeUInt16LE(method, offset + 8)
     }
   }
   return buffer
@@ -186,6 +202,35 @@ describe('assertOoxmlArchiveWithinLimits', () => {
     ).toThrow(/unsupported compression method 12/)
   })
 
+  it('rejects an entry whose central and local compression methods disagree', async () => {
+    // Claiming STORED centrally skips the bounded inflation, while SheetJS
+    // switches on the local header and would inflate the payload anyway.
+    const honest = await buildZip({ 'xl/worksheets/sheet1.xml': 'A'.repeat(200_000) })
+    const split = setCompressionMethod(honest, 0, 'central')
+
+    expect(() => assertOoxmlArchiveWithinLimits(split, HIGH_LIMITS)).toThrow(ZipBombError)
+    expect(() => assertOoxmlArchiveWithinLimits(split, HIGH_LIMITS)).toThrow(
+      /compression method 0 centrally but 8 locally/
+    )
+  })
+
+  it('rejects an entry whose central and local declared sizes disagree', async () => {
+    const honest = await buildZip({ 'word/document.xml': 'A'.repeat(200_000) })
+    const buffer = Buffer.from(honest)
+    for (let offset = 0; offset + 30 <= buffer.length; offset++) {
+      if (
+        buffer.readUInt32LE(offset) === LOCAL_FILE_HEADER_SIGNATURE &&
+        buffer.readUInt32LE(offset + 22) !== 0
+      ) {
+        buffer.writeUInt32LE(64, offset + 22)
+      }
+    }
+
+    expect(() => assertOoxmlArchiveWithinLimits(buffer, HIGH_LIMITS)).toThrow(
+      /200000 bytes centrally but .* locally/
+    )
+  })
+
   it('accepts a multi-entry archive whose entries all inflate to what they declare', async () => {
     const buffer = await buildZip({
       '[Content_Types].xml': '<?xml version="1.0"?><Types/>',

apps/sim/lib/file-parsers/zip-guard.ts

@@ -34,6 +34,9 @@ const UINT16_SENTINEL = 0xffff
 const COMPRESSION_METHOD_STORED = 0
 const COMPRESSION_METHOD_DEFLATE = 8
 
+/** General-purpose bit 3: sizes live in a trailing data descriptor, not the local header. */
+const DATA_DESCRIPTOR_FLAG = 0x0008
+
 export interface OoxmlSizeLimits {
   /** Hard ceiling on the summed declared uncompressed size of all entries. */
   maxTotalUncompressedBytes: number
@@ -274,6 +277,12 @@ function sumDeclaredUncompressedSize(buffer: Buffer, abortAboveBytes: number): n
  * to exactly what it declared and passes, having already been bounded by
  * {@link sumDeclaredUncompressedSize}.
  *
+ * The central and local headers must also agree on the compression method and
+ * sizes, because the parsers disagree about which one to trust — JSZip reads
+ * the central directory, SheetJS switches on the local header — and a record
+ * that reads as STORED here but DEFLATE downstream would skip inflation
+ * verification entirely.
+ *
  * Returns an error message when the archive is lying or is shaped in a way that
  * cannot be verified, and `null` when every entry checks out.
  */
@@ -310,6 +319,31 @@ function findInflationMismatch(buffer: Buffer, location: CentralDirectoryLocatio
       return 'entry data starts outside the archive'
     }
 
+    // The two headers must agree on how the payload is encoded. JSZip trusts
+    // the central directory while SheetJS switches on the local header's
+    // method, so a record that claims STORED centrally and DEFLATE locally
+    // would skip verification here and still be inflated downstream.
+    const localFlags = buffer.readUInt16LE(localHeaderOffset + 6)
+    const localMethod = buffer.readUInt16LE(localHeaderOffset + 8)
+    if (localMethod !== compressionMethod) {
+      return `entry declares compression method ${compressionMethod} centrally but ${localMethod} locally`
+    }
+
+    // Sizes must agree too, for the same reason. They are legitimately absent
+    // from the local header when the data-descriptor flag is set, and are
+    // sentinels under ZIP64, so only compare when both are actually present.
+    const hasDataDescriptor = (localFlags & DATA_DESCRIPTOR_FLAG) !== 0
+    const localCompressedSize = buffer.readUInt32LE(localHeaderOffset + 18)
+    const localUncompressedSize = buffer.readUInt32LE(localHeaderOffset + 22)
+    if (
+      !hasDataDescriptor &&
+      localCompressedSize !== UINT32_SENTINEL &&
+      localUncompressedSize !== UINT32_SENTINEL &&
+      (localCompressedSize !== compressedSize || localUncompressedSize !== uncompressedSize)
+    ) {
+      return `entry declares ${compressedSize}/${uncompressedSize} bytes centrally but ${localCompressedSize}/${localUncompressedSize} locally`
+    }
+
     if (compressionMethod === COMPRESSION_METHOD_STORED) {
       // A stored entry is its own payload, so any divergence is a lie outright.
       if (uncompressedSize !== compressedSize) {