appcore/gz/gz.go

// Copyright 2025 Patial Tech (Ankit Patial).
//
// This file is part of code.patial.tech/go/appcore, which is MIT licensed.
// See http://opensource.org/licenses/MIT

package gz

import (
	"bytes"
	"compress/gzip"
	"errors"
	"io"
)

// MaxDecompressedSize is the maximum allowed size for decompressed data (256MB).
// This prevents decompression bomb attacks. Override if you need larger outputs.
var MaxDecompressedSize int64 = 256 << 20

func Zip(data []byte) ([]byte, error) {
	var b bytes.Buffer
	gz := gzip.NewWriter(&b)
	if _, err := gz.Write(data); err != nil {
		return nil, err
	}

	if err := gz.Flush(); err != nil {
		return nil, err
	}

	if err := gz.Close(); err != nil {
		return nil, err
	}

	return b.Bytes(), nil
}

func UnZip(data []byte) ([]byte, error) {
	b := bytes.NewBuffer(data)
	r, err := gzip.NewReader(b)
	if err != nil {
		return nil, err
	}
	defer r.Close() // Ensure reader is closed to prevent resource leak

	var resB bytes.Buffer
	if _, err := io.Copy(&resB, io.LimitReader(r, MaxDecompressedSize+1)); err != nil {
		return nil, err
	}

	if int64(resB.Len()) > MaxDecompressedSize {
		return nil, errors.New("gz: decompressed data exceeds maximum allowed size")
	}

	return resB.Bytes(), nil
}