feat(labrinth): allow protected resource and data packs to pass validation (#3792)

* fix(labrinth): return version artifact size exceeded error eagerly

Now we don't wait until the result memory buffer has grown to a size
greater than the maximum allowed, and instead we return such an error
before the buffer is grown with the current chunk, which should reduce
memory usage.

* fix(labrinth): proper supported game versions range for datapacks

* feat(labrinth): allow protected resource and data packs to pass validation

apps/labrinth/src/validate/mod.rs

@@ -17,10 +17,14 @@ use crate::validate::rift::RiftValidator;
 use crate::validate::shader::{
     CanvasShaderValidator, CoreShaderValidator, ShaderValidator,
 };
+use bytes::Bytes;
 use chrono::{DateTime, Utc};
-use std::io::Cursor;
+use std::io::{self, Cursor};
+use std::mem;
+use std::sync::LazyLock;
 use thiserror::Error;
 use zip::ZipArchive;
+use zip::result::ZipError;
 
 mod datapack;
 mod fabric;
@@ -80,14 +84,43 @@ pub enum SupportedGameVersions {
     Custom(Vec<MinecraftGameVersion>),
 }
 
+pub enum MaybeProtectedZipFile {
+    Unprotected(ZipArchive<Cursor<Bytes>>),
+    MaybeProtected { read_error: ZipError, data: Bytes },
+}
+
 pub trait Validator: Sync {
     fn get_file_extensions(&self) -> &[&str];
     fn get_supported_loaders(&self) -> &[&str];
     fn get_supported_game_versions(&self) -> SupportedGameVersions;
+
     fn validate(
         &self,
         archive: &mut ZipArchive<Cursor<bytes::Bytes>>,
-    ) -> Result<ValidationResult, ValidationError>;
+    ) -> Result<ValidationResult, ValidationError> {
+        // By default, any non-protected ZIP archive is valid
+        let _ = archive;
+        Ok(ValidationResult::Pass)
+    }
+
+    fn validate_maybe_protected_zip(
+        &self,
+        file: &mut MaybeProtectedZipFile,
+    ) -> Result<ValidationResult, ValidationError> {
+        // By default, validate that the ZIP file is not protected, and if so,
+        // delegate to the inner validate method with a known good archive
+        match file {
+            MaybeProtectedZipFile::Unprotected(archive) => {
+                self.validate(archive)
+            }
+            MaybeProtectedZipFile::MaybeProtected { read_error, .. } => {
+                Err(ValidationError::Zip(mem::replace(
+                    read_error,
+                    ZipError::Io(io::Error::other("ZIP archive reading error")),
+                )))
+            }
+        }
+    }
 }
 
 static ALWAYS_ALLOWED_EXT: &[&str] = &["zip", "txt"];
@@ -113,6 +146,29 @@ static VALIDATORS: &[&dyn Validator] = &[
     &NeoForgeValidator,
 ];
 
+/// A regex that matches a potentially protected ZIP archive containing
+/// a vanilla Minecraft pack, with a requisite `pack.mcmeta` file.
+///
+/// Please note that this regex avoids false negatives at the cost of false
+/// positives being possible, i.e. it may match files that are not actually
+/// Minecraft packs, but it will not miss packs that the game can load.
+static PLAUSIBLE_PACK_REGEX: LazyLock<regex::bytes::Regex> =
+    LazyLock::new(|| {
+        regex::bytes::RegexBuilder::new(concat!(
+            r"\x50\x4b\x01\x02", // CEN signature
+            r".{24}",            // CEN fields
+            r"[\x0B\x0C]\x00",   // CEN file name length
+            r".{16}",            // More CEN fields
+            r"pack\.mcmeta/?",   // CEN file name
+            r".*",               // Rest of CEN entries and records
+            r"\x50\x4b\x05\x06", // EOCD signature
+        ))
+        .unicode(false)
+        .dot_matches_new_line(true)
+        .build()
+        .unwrap()
+    });
+
 /// The return value is whether this file should be marked as primary or not, based on the analysis of the file
 #[allow(clippy::too_many_arguments)]
 pub async fn validate_file(
@@ -144,7 +200,7 @@ pub async fn validate_file(
 }
 
 async fn validate_minecraft_file(
-    data: bytes::Bytes,
+    data: Bytes,
     file_extension: String,
     loaders: Vec<Loader>,
     game_versions: Vec<MinecraftGameVersion>,
@@ -152,13 +208,18 @@ async fn validate_minecraft_file(
     file_type: Option<FileType>,
 ) -> Result<ValidationResult, ValidationError> {
     actix_web::web::block(move || {
-        let reader = Cursor::new(data);
-        let mut zip = ZipArchive::new(reader)?;
+        let mut zip = match ZipArchive::new(Cursor::new(Bytes::clone(&data))) {
+            Ok(zip) => MaybeProtectedZipFile::Unprotected(zip),
+            Err(read_error) => MaybeProtectedZipFile::MaybeProtected {
+                read_error,
+                data,
+            },
+        };
 
         if let Some(file_type) = file_type {
             match file_type {
                 FileType::RequiredResourcePack | FileType::OptionalResourcePack => {
-                    return PackValidator.validate(&mut zip);
+                    return PackValidator.validate_maybe_protected_zip(&mut zip);
                 }
                 FileType::Unknown => {}
             }
@@ -177,7 +238,7 @@ async fn validate_minecraft_file(
                 )
             {
                 if validator.get_file_extensions().contains(&&*file_extension) {
-                    let result = validator.validate(&mut zip)?;
+                    let result = validator.validate_maybe_protected_zip(&mut zip)?;
                     match result {
                         ValidationResult::PassWithPackDataAndFiles { .. } => {
                             saved_result = Some(result);