Limit zip file entries to 100MB by default

[pmachapman]

Part of the fix for sillsdev/serval#974

---

This change is 

[codecov-commenter]

Codecov Report

❌ Patch coverage is 56.71642% with 29 lines in your changes missing coverage. Please review.
✅ Project coverage is 73.51%. Comparing base (5d26fac) to head (99e094d).

Files with missing lines	Patch %	Lines
src/SIL.Machine/Utils/BoundedStream.cs	50.00%	23 Missing and 2 partials ⚠️
...L.Machine/Corpora/ZipParatextProjectFileHandler.cs	0.00%	1 Missing and 1 partial ⚠️
src/SIL.Machine/Utils/ZipArchiveEntryExtensions.cs	84.61%	1 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #481      +/-   ##
==========================================
- Coverage   73.53%   73.51%   -0.03%     
==========================================
  Files         449      451       +2     
  Lines       37633    37692      +59     
  Branches     5174     5183       +9     
==========================================
+ Hits        27673    27708      +35     
- Misses       8824     8845      +21     
- Partials     1136     1139       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ddaspit]

@ddaspit reviewed 6 files and all commit messages, and made 1 comment.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on pmachapman).

---

src/SIL.Machine/Utils/ZipArchiveEntryExtensions.cs line 40 at r1 (raw file):

            }

            return new BoundedStream(entry.Open(), maxUncompressedSize);

Is the BoundedStream class necessary if we are already checking the uncompressed size? Is ZipArchiveEntry.Length not reliable?

[pmachapman]

@pmachapman made 1 comment.
Reviewable status: all files reviewed, 1 unresolved discussion (waiting on ddaspit).

---

src/SIL.Machine/Utils/ZipArchiveEntryExtensions.cs line 40 at r1 (raw file):

Previously, ddaspit (Damien Daspit) wrote…

Is the BoundedStream class necessary if we are already checking the uncompressed size? Is ZipArchiveEntry.Length not reliable?

entry.Length is from the zip file entry header. In a corrupted or malicious zip file, this can be inaccurate, as it is set when the zip file entry is created, rather than calculated from the compressed data. As far as I am aware dotnet performs no bounds checking on the stream in its ZipArchiveEntry implementation.

[ddaspit]

@ddaspit made 1 comment and resolved 1 discussion.
Reviewable status: complete! all files reviewed, all discussions resolved (waiting on pmachapman).