Harden zip reader and syslog scan

internal/parser/archive.go

@@ -13,6 +13,7 @@ import (
 )
 
 const maxSingleFileSize = 10 * 1024 * 1024
+const maxZipArchiveSize = 50 * 1024 * 1024
 
 // ExtractedFile represents a file extracted from archive
 type ExtractedFile struct {
@@ -222,11 +223,14 @@ func extractZip(archivePath string) ([]ExtractedFile, error) {
 }
 
 func extractZipFromReader(r io.Reader) ([]ExtractedFile, error) {
-	// Read all data into memory
+	// Read all data into memory with a hard cap
-	data, err := io.ReadAll(r)
+	data, err := io.ReadAll(io.LimitReader(r, maxZipArchiveSize+1))
 	if err != nil {
 		return nil, fmt.Errorf("read zip data: %w", err)
 	}
+	if len(data) > maxZipArchiveSize {
+		return nil, fmt.Errorf("zip too large: max %d bytes", maxZipArchiveSize)
+	}
 
 	// Create a ReaderAt from the byte slice
 	readerAt := bytes.NewReader(data)

internal/parser/vendors/unraid/parser.go

@@ -412,6 +412,9 @@ func parseSMARTFileToMap(content, filePath string, storageBySlot map[string]*mod
 	if m := regexp.MustCompile(`(disk\d+|parity|cache\d*)`).FindStringSubmatch(filePath); len(m) > 0 {
 		diskName = m[1]
 	}
+	if diskName == "" {
+		return
+	}
 
 	var disk models.Storage
 	disk.Slot = diskName
@@ -503,6 +506,7 @@ func parseSMARTFileToMap(content, filePath string, storageBySlot map[string]*mod
 
 func parseSyslog(content string, result *models.AnalysisResult) {
 	scanner := bufio.NewScanner(strings.NewReader(content))
+	scanner.Buffer(make([]byte, 0, 64*1024), 1024*1024)
 	lineCount := 0
 	maxLines := 100 // Limit parsing to avoid too many events
 
@@ -527,6 +531,17 @@ func parseSyslog(content string, result *models.AnalysisResult) {
 
 		lineCount++
 	}
+
+	if err := scanner.Err(); err != nil {
+		result.Events = append(result.Events, models.Event{
+			Timestamp:   time.Now(),
+			Source:      "syslog",
+			EventType:   "System Log",
+			Severity:    models.SeverityWarning,
+			Description: "syslog scan error",
+			RawData:     err.Error(),
+		})
+	}
 }
 
 func parseSyslogLine(line string) (time.Time, string, models.Severity) {