37 lines
2.7 KiB
Markdown
37 lines
2.7 KiB
Markdown
# Privacy and security
|
|
|
|
## Privacy
|
|
|
|
Inputs remain in the browser. There is no telemetry, account, analytics, upload endpoint, persistence or runtime CDN. Object URLs exist only long enough to display or download local results and are revoked after use.
|
|
|
|
## Threat model
|
|
|
|
Archives are adversarial binary input. Relevant risks include traversal and alternate-stream names, normalization/case collisions, deceptive local versus central ZIP headers, overlapping ZIP entries, CRC corruption, compression bombs, integer overflow, excessive counts, malformed PAX lengths, active HTML/SVG, recursive nested archives and special filesystem entries.
|
|
|
|
Archive Tools responds as follows:
|
|
|
|
- source, count, expanded-byte, per-entry, ratio, path and preview budgets are fixed in `src/archive/limits.ts`;
|
|
- byte arithmetic uses checked safe integers and bounds before slicing;
|
|
- extraction never targets the filesystem: eligible content is verified and repackaged into a newly created ZIP;
|
|
- ZIP content reads enable CRC-32, strict local/central agreement and overlapping-entry checks;
|
|
- every TAR header checksum is verified; PAX and GNU long-name/link metadata are bounded and decoded strictly;
|
|
- gzip output and member count are bounded during streaming and every member's CRC-32/ISIZE footer is independently verified;
|
|
- path collision keys are Unicode-normalized and conservative across case-insensitive platforms;
|
|
- symlinks, hardlinks, devices, FIFOs and unknown types are never restored;
|
|
- imported text is rendered as text, and HTML/SVG are not mounted as documents;
|
|
- raster images must pass byte/dimension/pixel/static checks before a browser decoder sees their Blob URL;
|
|
- nested archives are shown as bytes and never recursively opened;
|
|
- ZipCrypto and WinZip AES entries require an explicit memory-only password; CRC-32 (where present) and AES authentication codes are checked. ZipCrypto is labelled cryptographically weak;
|
|
- multipart ZIP plus 7z/RAR decompression and extraction remain explicitly
|
|
unsupported. Bounded 7z/RAR structural inspection validates container/header
|
|
CRC evidence and inventories safe plaintext metadata only; encrypted or
|
|
encoded headers are not decrypted.
|
|
|
|
## Limits
|
|
|
|
The primary ceilings are 512 MiB source and aggregate expanded data, 256 MiB per entry, 20,000 entries and a 200:1 compression ratio. Preview limits are substantially smaller. Near-limit workloads may still be impractical on low-memory devices; the limits reduce risk but do not make untrusted archives inherently safe.
|
|
|
|
## Output meaning
|
|
|
|
“Safe file” means eligible for bounded verification and inclusion in a new ZIP under this policy. It is not a malware verdict. Archive Tools does not scan file semantics and does not make copied files trustworthy to open in another application.
|