Function extractAndValidateZip

worker/src/components/security/nuclei.ts:657–727

(
  zipBuffer: Buffer,
  context: any,
)

}

async function extractAndValidateZip(
  zipBuffer: Buffer,
  context: any,
): Promise<Record<string, Buffer>> {
  try {
    const AdmZip = require('adm-zip');
    const zip = new AdmZip(zipBuffer);
    const zipEntries = zip.getEntries();

    const files: Record<string, Buffer> = {};
    let totalSize = 0;
    const maxSingleFileSize = 1024 * 1024; // 1MB per file

    for (const entry of zipEntries) {
      if (entry.isDirectory) {
        continue;
      }

      if (!entry.entryName.endsWith('.yaml') && !entry.entryName.endsWith('.yml')) {
        context.logger.warn(`[Nuclei] Skipping non-YAML file: ${entry.entryName}`);
        continue;
      }

      if (entry.entryName.includes('..') || entry.entryName.startsWith('/')) {
        context.logger.warn(`[Nuclei] Skipping file with invalid path: ${entry.entryName}`);
        continue;
      }

      const fileData = entry.getData();
      if (fileData.length > maxSingleFileSize) {
        context.logger.warn(
          `[Nuclei] Skipping oversized file: ${entry.entryName} (${(fileData.length / 1024).toFixed(1)}KB)`,
        );
        continue;
      }

      totalSize += fileData.length;

      try {
        validateNucleiTemplate(fileData.toString('utf-8'));
        files[entry.entryName] = fileData;
      } catch (error) {
        context.logger.warn(
          `[Nuclei] Skipping invalid template ${entry.entryName}: ${error instanceof Error ? error.message : 'validation failed'}`,
        );
      }
    }

    if (Object.keys(files).length === 0) {
      throw new ValidationError('No valid YAML templates found in archive', {
        details: { archiveSizeBytes: zipBuffer.length },
      });
    }

    context.logger.info(
      `[Nuclei] Validated ${Object.keys(files).length} templates (${(totalSize / 1024).toFixed(1)}KB total)`,
    );