internal/helm: check size of meta files in package

Signed-off-by: Hidde Beydals <hello@hidde.co>
fluxcd · Nov 23, 2021 · 9233939 · 9233939
1 parent fa13dd7
commit 9233939
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/internal/helm/chart/metadata.go b/internal/helm/chart/metadata.go
@@ -223,6 +223,9 @@ func LoadChartMetadataFromArchive(archive string) (*helmchart.Metadata, error) {
 
 		switch parts[1] {
 		case chartutil.ChartfileName, "requirements.yaml":
+			if hd.Size > helm.MaxChartFileSize {
+				return nil, fmt.Errorf("size of '%s' exceeds '%d' bytes limit", hd.Name, helm.MaxChartFileSize)
+			}
 			b, err := io.ReadAll(tr)
 			if err != nil {
 				return nil, err