judge: fix

packages/hydrojudge/package.json

@@ -1,12 +1,13 @@
 {
     "name": "@hydrooj/hydrojudge",
     "bin": "bin/hydrojudge.js",
-    "version": "3.3.5",
+    "version": "3.3.6",
     "main": "./src/index.ts",
     "author": "undefined <i@undefined.moe>",
     "repository": "https://github.com/hydro-dev/Hydro.git",
     "dependencies": {
         "@hydrooj/utils": "workspace:*",
+        "adm-zip": "0.5.5",
         "cac": "^6.7.14",
         "p-queue": "^8.0.1",
         "schemastery": "^3.14.3",
@@ -18,6 +19,7 @@
     "preferUnplugged": true,
     "license": "AGPL-3.0-or-later",
     "devDependencies": {
+        "@types/adm-zip": "^0.4.34",
         "@types/shell-quote": "^1.7.5",
         "@types/ws": "^8.5.10"
     }

packages/hydrojudge/src/hosts/vj4.ts

@@ -151,6 +151,7 @@ export default class VJ4 implements Session {
             const zip = new AdmZip(tmpFilePath);
             const entries = zip.getEntries();
             if (entries.length > 512) throw new FormatError('Too many files');
+            if (Math.sum(entries.map((i) => i.header.size)) > 256 * 1024 * 1024) throw new FormatError('File too large');
             await new Promise((resolve, reject) => {
                 zip.extractAllToAsync(savePath, true, (e) => {
                     if (e) reject(e);