Prevent zlib-based DoS when parsing the cookie containing paste tokens.

Fixes LP #1094049.

doc/CHANGES.rst

@@ -8,6 +8,9 @@ http://docs.zope.org/zope2/
 2.13.21 (unreleased)
 --------------------
 
+- LP #1094049:  prevent zlib-based DoS when parsing the cookie containing
+  paste tokens.
+
 - Updated distributions:
 
   - AccessControl = 2.13.12

src/OFS/CopySupport.py

@@ -23,7 +23,7 @@ from urllib import quote
 from urllib import unquote
 import warnings
 from zlib import compress
-from zlib import decompress
+from zlib import decompressobj
 import transaction
 
 from AccessControl import ClassSecurityInfo
@@ -647,8 +647,12 @@ def absattr(attr):
 def _cb_encode(d):
     return quote(compress(dumps(d), 9))
 
-def _cb_decode(s):
-    return loads(decompress(unquote(s)))
+def _cb_decode(s, maxsize=8192):
+    dec = decompressobj()
+    data = dec.decompress(unquote(s), maxsize)
+    if dec.unconsumed_tail:
+        raise ValueError
+    return loads(data)
 
 def cookie_path(request):
     # Return a "path" value for use in a cookie that refers