fix: optimize packages upload memory (#39366)

Bound the memory used when parsing uploaded packages, so instances with
low memory limits survive non-standard packages.

1. Metadata files are read through a size-limited reader, archives
themselves stay unbounded so large payloads keep working
2. zstd decoding caps the window at 128 MiB, the zstd CLI default
3. RPM headers go through a first-party reader with rpmlib's size and
array count limits that allocates only what the upload contains, until
https://github.com/sassoftware/go-rpmutils/pull/44 is released. Signing
still verifies the payload digest, and its signature header matches
rpmsign's byte for byte
4. Swift and NuGet read the zip entry they size-checked, a duplicate
name could stand in for it before
5. Terraform states check `LIMIT_SIZE_TERRAFORM_STATE` before parsing,
NuGet symbol PDBs share a 256 MiB budget
6. Oversized container configs are rejected instead of stored without
metadata, invalid Vagrant boxes answer 400 instead of 500

Signed-off-by: techknowlogick <git@tklk.dev>
Co-authored-by: techknowlogick <git@tklk.dev>
Co-authored-by: silverwind <me@silverwind.io>
Co-authored-by: techknowlogick <techknowlogick@gitea.com>

modules/zstd/zstd.go

@@ -39,9 +39,11 @@ type Reader zstd.Decoder
 
 var _ io.ReadCloser = (*Reader)(nil)
 
+const defaultMaxWindowSize = 128 * 1024 * 1024 // the zstd CLI's default, bounds the history buffer an untrusted frame can request
+
 // NewReader returns a new zstd reader.
 func NewReader(r io.Reader, opts ...ReaderOption) (*Reader, error) {
-	zstdR, err := zstd.NewReader(r, opts...)
+	zstdR, err := zstd.NewReader(r, append([]ReaderOption{zstd.WithDecoderMaxWindow(defaultMaxWindowSize)}, opts...)...)
 	if err != nil {
 		return nil, err
 	}

modules/zstd/zstd_test.go

@@ -11,6 +11,7 @@ import (
 	"strings"
 	"testing"
 
+	"github.com/klauspost/compress/zstd"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
 )
@@ -61,6 +62,14 @@ func TestWriterReader(t *testing.T) {
 
 		assert.Equal(t, testData, data)
 	})
+
+	t.Run("rejects window above 128 MiB", func(t *testing.T) {
+		frameWith256MiBWindow := []byte{0x28, 0xb5, 0x2f, 0xfd, 0x00, 0x90, 0x01, 0x00, 0x00}
+		reader, err := NewReader(bytes.NewReader(frameWith256MiBWindow))
+		require.NoError(t, err)
+		_, err = io.ReadAll(reader)
+		assert.ErrorIs(t, err, zstd.ErrWindowSizeExceeded)
+	})
 }
 
 func TestSeekableWriterReader(t *testing.T) {