fix: prevent DoS and resource exhaustion attacks

packages/alphatab/src/ImporterSettings.ts

@@ -63,4 +63,16 @@ export class ImporterSettings {
      * ![Disabled](https://alphatab.net/img/reference/property/beattextaslyrics-disabled.png)
      */
     public beatTextAsLyrics: boolean = false;
+
+    /**
+     * This setting controls the escape hatch for handling potentially malicous or corrupt
+     * input files. At selected spots in the codebase, we use this buffer size as maximum
+     * allowed sizes. e.g. during unzipping or decoding strings.
+     * This prevents resource exhaustion, especially when alphaTab is used on server side.
+     * Increase this buffer size if you need to handle very big files.
+     * @defaultValue `128000000`
+     * @category Core
+     * @since 1.9.0
+     */
+    public maxDecodingBufferSize: number = 128000000;
 }

packages/alphatab/src/generated/ImporterSettingsJson.ts

@@ -67,4 +67,15 @@ export interface ImporterSettingsJson {
      * ![Disabled](https://alphatab.net/img/reference/property/beattextaslyrics-disabled.png)
      */
     beatTextAsLyrics?: boolean;
+    /**
+     * This setting controls the escape hatch for handling potentially malicous or corrupt
+     * input files. At selected spots in the codebase, we use this buffer size as maximum
+     * allowed sizes. e.g. during unzipping or decoding strings.
+     * This prevents resource exhaustion, especially when alphaTab is used on server side.
+     * Increase this buffer size if you need to handle very big files.
+     * @defaultValue `128000000`
+     * @category Core
+     * @since 1.9.0
+     */
+    maxDecodingBufferSize?: number;
 }

packages/alphatab/src/generated/ImporterSettingsSerializer.ts

@@ -23,6 +23,7 @@ export class ImporterSettingsSerializer {
         o.set("encoding", obj.encoding);
         o.set("mergepartgroupsinmusicxml", obj.mergePartGroupsInMusicXml);
         o.set("beattextaslyrics", obj.beatTextAsLyrics);
+        o.set("maxdecodingbuffersize", obj.maxDecodingBufferSize);
         return o;
     }
     public static setProperty(obj: ImporterSettings, property: string, v: unknown): boolean {
@@ -36,6 +37,9 @@ export class ImporterSettingsSerializer {
             case "beattextaslyrics":
                 obj.beatTextAsLyrics = v! as boolean;
                 return true;
+            case "maxdecodingbuffersize":
+                obj.maxDecodingBufferSize = v! as number;
+                return true;
         }
         return false;
     }

packages/alphatab/src/importer/BinaryStylesheet.ts

@@ -76,18 +76,18 @@ export class BinaryStylesheet {
     private readonly _types: Map<string, DataType> = new Map();
     public readonly raw: Map<string, unknown> = new Map();
 
-    public constructor(data?: Uint8Array) {
+    public constructor(data?: Uint8Array, maxDecodingBufferSize: number = 0) {
         if (data) {
-            this._read(data);
+            this._read(data, maxDecodingBufferSize);
         }
     }
 
-    private _read(data: Uint8Array) {
+    private _read(data: Uint8Array, maxDecodingBufferSize: number) {
         // BinaryStylesheet apears to be big-endien
         const readable: ByteBuffer = ByteBuffer.fromBuffer(data);
         const entryCount: number = IOHelper.readInt32BE(readable);
         for (let i: number = 0; i < entryCount; i++) {
-            const key: string = GpBinaryHelpers.gpReadString(readable, readable.readByte(), 'utf-8');
+            const key: string = GpBinaryHelpers.gpReadString(readable, readable.readByte(), 'utf-8', maxDecodingBufferSize);
             const type: DataType = readable.readByte() as DataType;
             this._types.set(key, type);
             switch (type) {
@@ -104,7 +104,7 @@ export class BinaryStylesheet {
                     this.addValue(key, fvalue);
                     break;
                 case DataType.String:
-                    const s: string = GpBinaryHelpers.gpReadString(readable, IOHelper.readInt16BE(readable), 'utf-8');
+                    const s: string = GpBinaryHelpers.gpReadString(readable, IOHelper.readInt16BE(readable), 'utf-8', maxDecodingBufferSize);
                     this.addValue(key, s);
                     break;
                 case DataType.Point:

packages/alphatab/src/importer/CapellaImporter.ts

@@ -21,7 +21,7 @@ export class CapellaImporter extends ScoreImporter {
 
     public readScore(): Score {
         Logger.debug(this.name, 'Loading ZIP entries');
-        const fileSystem: ZipReader = new ZipReader(this.data);
+        const fileSystem: ZipReader = new ZipReader(this.data, this.settings.importer.maxDecodingBufferSize);
         let entries: ZipEntry[];
         let xml: string | null = null;
         entries = fileSystem.read();