Ericsson/codechecker v6.29.3 on GitHub

Fix ZIP bomb vulnerability in massStoreRun
The unzip() function in massStoreRun previously decompressed the entire uploaded ZIP into memory before writing it to disk, making it trivially exploitable by a malicious client sending a highly-compressed payload (ZIP bomb). The fix applies two independent limits using a 16 GiB cap:
- During zlib decompression, decompressobj().decompress() is now called with max_length=16 GiB; a non-empty unconsumed_tail after decompression indicates the limit was exceeded and the request is rejected.
- During ZIP extraction, file sizes are accumulated per-member before extraction; if the total exceeds 16 GiB the request is rejected before any data is written.
Prevent XSS script injection in static HTML output
CodeChecker parse and CodeChecker cmd diff can generate static HTML pages displaying reports. Report messages containing </script> tags could previously be injected into the page's code, enabling XSS attacks. This is now properly escaped.
Invalidate session tokens at logout across all worker processes
After a user logs out, session tokens are now invalidated at all worker processes. Session validity is checked in the central database on each API request, throttled by the refresh_time configuration parameter.