fix(security): guard two OOXML paths that reached JSZip without a zip-bomb check (#7526)

`extractDocxText` rescues a parse failure by re-reading the package as a
possibly-empty document, and that rescue handed the buffer to JSZip with no size
guard — so a zip bomb, whose rejection is exactly what routes it there, got its
`word/document.xml` read into a string uncapped. Guard the rescue the way every
other JSZip call site in the file already does, outside the catch so the
rejection propagates.

`extractDocAssets` handed an attacker-supplied .pptx/.docx straight to JSZip and
inflated every media entry into a retained Buffer, with only a compressed-size
ceiling upstream. Apply the same shared guard the document parsers and
`extractDocumentStyle` already apply to the same class of input.

No new limits are introduced — both call sites now use the existing shared
ceilings, so a file rejected here is one Sim's text-extraction path already
rejects today.


Claude-Session: https://claude.ai/code/session_01VmwJP8EmSo3KcMFoKjpd6y

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/lib/copilot/tools/server/files/doc-asset-extract.test.ts

@@ -4,6 +4,7 @@
 import JSZip from 'jszip'
 import { describe, expect, it } from 'vitest'
 import { extractDocAssets } from '@/lib/copilot/tools/server/files/doc-asset-extract'
+import { MAX_OOXML_CENTRAL_DIRECTORY_RECORDS, ZipBombError } from '@/lib/file-parsers/ooxml-limits'
 
 const THEME_XML = `<?xml version="1.0"?>
 <a:theme xmlns:a="http://schemas.openxmlformats.org/drawingml/2006/main" name="Office">
@@ -143,6 +144,21 @@ describe('extractDocAssets', () => {
     expect(slide.texts.some((t) => t.text.includes('grouped'))).toBe(false)
   })
 
+  it('refuses an archive the OOXML guard rejects', async () => {
+    // Every media entry is inflated into a retained Buffer with no cap of its
+    // own, so the guard is the only thing bounding this. Tripping its
+    // record-count ceiling asserts the call site is guarded without building a
+    // multi-megabyte fixture; the size ceilings are covered in zip-guard.test.ts.
+    const zip = new JSZip()
+    for (let index = 0; index <= MAX_OOXML_CENTRAL_DIRECTORY_RECORDS; index++) {
+      zip.file(`ppt/media/image${index}.png`, PNG_BYTES)
+    }
+
+    await expect(
+      extractDocAssets(await zip.generateAsync({ type: 'nodebuffer' }), 'pptx')
+    ).rejects.toThrow(ZipBombError)
+  })
+
   it('tolerates a package with no theme or media', async () => {
     const zip = new JSZip()
     zip.file('ppt/slides/slide1.xml', '<p:sld/>')

apps/sim/lib/copilot/tools/server/files/doc-asset-extract.ts

@@ -1,4 +1,5 @@
 import JSZip from 'jszip'
+import { assertOoxmlArchiveWithinLimits } from '@/lib/file-parsers/zip-guard'
 
 /**
  * Pulls the reusable design material out of an OOXML document (.pptx/.docx):
@@ -370,6 +371,11 @@ export async function extractDocAssets(
   binary: Buffer,
   format: 'pptx' | 'docx'
 ): Promise<ExtractedDocAssets> {
+  // The media loop below inflates every entry into a retained Buffer, so an
+  // attacker-supplied archive has to be bounded from its central directory first —
+  // the same guard `extractDocumentStyle` and the document parsers already apply.
+  assertOoxmlArchiveWithinLimits(binary)
+
   const zip = await JSZip.loadAsync(binary)
   const prefix = format === 'pptx' ? 'ppt' : 'word'
 

apps/sim/lib/microsoft-word/document.server.test.ts

@@ -4,6 +4,7 @@
 import { Document, Header, Packer, Paragraph, TextRun } from 'docx'
 import JSZip from 'jszip'
 import { describe, expect, it } from 'vitest'
+import { MAX_OOXML_CENTRAL_DIRECTORY_RECORDS, ZipBombError } from '@/lib/file-parsers/ooxml-limits'
 import {
   appendParagraphsToDocx,
   buildDocxFromContent,
@@ -199,6 +200,21 @@ describe('extractDocxText', () => {
     await expect(extractDocxText(blank)).resolves.toBe('')
   })
 
+  it('refuses an archive the OOXML guard rejects rather than rescuing it', async () => {
+    // The rescue re-opens the buffer with JSZip and reads `word/document.xml`
+    // into a string with no size cap, and the parser rejecting the archive is
+    // exactly what routes it there. The body stays empty so the rescue would
+    // otherwise succeed — reporting the archive as an empty document.
+    const zip = await JSZip.loadAsync(await buildDocxFromContent(''))
+    for (let index = 0; index <= MAX_OOXML_CENTRAL_DIRECTORY_RECORDS; index++) {
+      zip.file(`word/embeddings/pad${index}.bin`, '')
+    }
+
+    await expect(extractDocxText(await zip.generateAsync({ type: 'nodebuffer' }))).rejects.toThrow(
+      ZipBombError
+    )
+  })
+
   it('still fails on an archive that is not a Word package', async () => {
     const zip = new JSZip()
     zip.file('hello.txt', 'not a word document')

apps/sim/lib/microsoft-word/document.server.ts

@@ -249,6 +249,12 @@ export async function extractDocxText(buffer: Buffer): Promise<string> {
 
 /** Whether the buffer is a valid Word package whose body holds no text. */
 async function isEmptyWordPackage(buffer: Buffer): Promise<boolean> {
+  // Reached with the untrusted buffer the parser just rejected — including when it
+  // rejected it as a zip bomb. Without this the rescue reads `word/document.xml`
+  // into a string with no size cap, making the guard the trigger for the expansion
+  // it prevents. Kept outside the catch so the rejection propagates.
+  assertOoxmlArchiveWithinLimits(buffer)
+
   try {
     const zip = await JSZip.loadAsync(buffer)
     const part = zip.file(DOCUMENT_PART_PATH)