feat: add configurable chart size limits via flags and env vars

Allow users to configure max chart size and max file size through
CLI flags (--max-chart-size, --max-file-size) and environment
variables (HELM_MAX_CHART_SIZE, HELM_MAX_FILE_SIZE) to address
cases where the security limits introduced in e4da497 are too
restrictive for some legitimate charts.

Signed-off-by: Benoit Tigeot <benoit.tigeot@lifen.fr>

internal/chart/v3/loader/archive.go

@@ -27,16 +27,34 @@ import (
 	"helm.sh/helm/v4/pkg/chart/loader/archive"
 )
 
-// FileLoader loads a chart from a file
-type FileLoader string
+// FileLoader loads a chart from a file with embedded options
+type FileLoader struct {
+	path string
+	opts archive.Options
+}
 
 // Load loads a chart
 func (l FileLoader) Load() (*chart.Chart, error) {
-	return LoadFile(string(l))
+	return LoadFile(l.path)
+}
+
+// NewFileLoader creates a file loader with custom options
+func NewFileLoader(path string, opts archive.Options) FileLoader {
+	return FileLoader{path: path, opts: opts}
+}
+
+// NewDefaultFileLoader creates a file loader with default options
+func NewDefaultFileLoader(path string) FileLoader {
+	return FileLoader{path: path, opts: archive.DefaultOptions}
 }
 
-// LoadFile loads from an archive file.
+// LoadFile loads from an archive file with default options
 func LoadFile(name string) (*chart.Chart, error) {
+	return LoadFileWithOptions(name, archive.DefaultOptions)
+}
+
+// LoadFile loads from an archive file with the provided options
+func LoadFileWithOptions(name string, opts archive.Options) (*chart.Chart, error) {
 	if fi, err := os.Stat(name); err != nil {
 		return nil, err
 	} else if fi.IsDir() {
@@ -54,7 +72,7 @@ func LoadFile(name string) (*chart.Chart, error) {
 		return nil, err
 	}
 
-	c, err := LoadArchive(raw)
+	c, err := LoadArchiveWithOptions(raw, opts)
 	if err != nil {
 		if err == gzip.ErrHeader {
 			return nil, fmt.Errorf("file '%s' does not appear to be a valid chart file (details: %s)", name, err)
@@ -65,7 +83,12 @@ func LoadFile(name string) (*chart.Chart, error) {
 
 // LoadArchive loads from a reader containing a compressed tar archive.
 func LoadArchive(in io.Reader) (*chart.Chart, error) {
-	files, err := archive.LoadArchiveFiles(in)
+	return LoadArchiveWithOptions(in, archive.DefaultOptions)
+}
+
+// LoadArchive loads from a reader containing a compressed tar archive with the provided options.
+func LoadArchiveWithOptions(in io.Reader, opts archive.Options) (*chart.Chart, error) {
+	files, err := archive.LoadArchiveFilesWithOptions(in, opts)
 	if err != nil {
 		return nil, err
 	}

internal/chart/v3/loader/directory.go

@@ -32,17 +32,39 @@ import (
 var utf8bom = []byte{0xEF, 0xBB, 0xBF}
 
 // DirLoader loads a chart from a directory
-type DirLoader string
+type DirLoader struct {
+	path string
+	opts archive.Options
+}
+
+// NewDirLoader creates a new directory loader with default options
+func NewDefaultDirLoader(path string) DirLoader {
+	return DirLoader{path: path, opts: archive.DefaultOptions}
+}
 
-// Load loads the chart
+// NewDirLoader creates a new directory loader with custom options
+func NewDirLoader(path string, opts archive.Options) DirLoader {
+	return DirLoader{path: path, opts: opts}
+}
+
+// Load loads the chart using default behavior for directories.
 func (l DirLoader) Load() (*chart.Chart, error) {
-	return LoadDir(string(l))
+	return LoadDir(l.path)
+}
+
+func (l DirLoader) LoadWithOptions() (*chart.Chart, error) {
+	return LoadDirWithOptions(l.path, l.opts)
+}
+
+// LoadDir loads from a directory with default options
+func LoadDir(dir string) (*chart.Chart, error) {
+	return LoadDirWithOptions(dir, archive.DefaultOptions)
 }
 
 // LoadDir loads from a directory.
 //
 // This loads charts only from directories.
-func LoadDir(dir string) (*chart.Chart, error) {
+func LoadDirWithOptions(dir string, opts archive.Options) (*chart.Chart, error) {
 	topdir, err := filepath.Abs(dir)
 	if err != nil {
 		return nil, err
@@ -100,8 +122,8 @@ func LoadDir(dir string) (*chart.Chart, error) {
 			return fmt.Errorf("cannot load irregular file %s as it has file mode type bits set", name)
 		}
 
-		if fi.Size() > archive.MaxDecompressedFileSize {
-			return fmt.Errorf("chart file %q is larger than the maximum file size %d", fi.Name(), archive.MaxDecompressedFileSize)
+		if fi.Size() > opts.MaxDecompressedFileSize {
+			return fmt.Errorf("chart file %q is larger than the maximum file size %d", fi.Name(), opts.MaxDecompressedFileSize)
 		}
 
 		data, err := os.ReadFile(name)

internal/chart/v3/loader/load.go

@@ -41,6 +41,18 @@ type ChartLoader interface {
 	Load() (*chart.Chart, error)
 }
 
+// LoadWithOptions takes a string name, resolves it to a file or directory, and loads it with custom options.
+func LoadWithOptions(name string, opts archive.Options) (*chart.Chart, error) {
+	fi, err := os.Stat(name)
+	if err != nil {
+		return nil, err
+	}
+	if fi.IsDir() {
+		return LoadDirWithOptions(name, opts)
+	}
+	return LoadFileWithOptions(name, opts)
+}
+
 // Loader returns a new ChartLoader appropriate for the given chart name
 func Loader(name string) (ChartLoader, error) {
 	fi, err := os.Stat(name)
@@ -48,9 +60,9 @@ func Loader(name string) (ChartLoader, error) {
 		return nil, err
 	}
 	if fi.IsDir() {
-		return DirLoader(name), nil
+		return NewDefaultDirLoader(name), nil
 	}
-	return FileLoader(name), nil
+	return NewDefaultFileLoader(name), nil
 }
 
 // Load takes a string name, tries to resolve it to a file or directory, and then loads it.

internal/chart/v3/util/expand.go

@@ -30,9 +30,14 @@ import (
 	"helm.sh/helm/v4/pkg/chart/loader/archive"
 )
 
-// Expand uncompresses and extracts a chart into the specified directory.
+// Expand uncompresses and extracts a chart into the specified directory using default options.
 func Expand(dir string, r io.Reader) error {
-	files, err := archive.LoadArchiveFiles(r)
+	return ExpandWithOptions(dir, r, archive.DefaultOptions)
+}
+
+// ExpandWithOptions uncompresses and extracts a chart into the specified directory using the provided options.
+func ExpandWithOptions(dir string, r io.Reader, opts archive.Options) error {
+	files, err := archive.LoadArchiveFilesWithOptions(r, opts)
 	if err != nil {
 		return err
 	}
@@ -83,12 +88,17 @@ func Expand(dir string, r io.Reader) error {
 	return nil
 }
 
-// ExpandFile expands the src file into the dest directory.
+// ExpandFile expands the src file into the dest directory using default options.
 func ExpandFile(dest, src string) error {
+	return ExpandFileWithOptions(dest, src, archive.DefaultOptions)
+}
+
+// ExpandFileWithOptions expands the src file into the dest directory using the provided options.
+func ExpandFileWithOptions(dest, src string, opts archive.Options) error {
 	h, err := os.Open(src)
 	if err != nil {
 		return err
 	}
 	defer h.Close()
-	return Expand(dest, h)
+	return ExpandWithOptions(dest, h, opts)
 }

pkg/action/install.go

@@ -132,6 +132,10 @@ type Install struct {
 	// Lock to control raceconditions when the process receives a SIGTERM
 	Lock           sync.Mutex
 	goroutineCount atomic.Int32
+	// MaxChartSize is the maximum size of a decompressed chart in bytes
+	MaxChartSize int64
+	// MaxChartFileSize is the maximum size of a single file in a chart in bytes
+	MaxChartFileSize int64
 }
 
 // ChartPathOptions captures common options used for controlling chart paths

pkg/action/pull.go

@@ -22,6 +22,7 @@ import (
 	"path/filepath"
 	"strings"
 
+	"helm.sh/helm/v4/pkg/chart/loader/archive"
 	chartutil "helm.sh/helm/v4/pkg/chart/v2/util"
 	"helm.sh/helm/v4/pkg/cli"
 	"helm.sh/helm/v4/pkg/downloader"
@@ -44,6 +45,10 @@ type Pull struct {
 	UntarDir    string
 	DestDir     string
 	cfg         *Configuration
+	// MaxChartSize is the maximum decompressed size of a chart in bytes
+	MaxChartSize int64
+	// MaxChartFileSize is the maximum size of a single file in a chart in bytes
+	MaxChartFileSize int64
 }
 
 type PullOpt func(*Pull)
@@ -169,7 +174,14 @@ func (p *Pull) Run(chartRef string) (string, error) {
 			return out.String(), fmt.Errorf("failed to untar: a file or directory with the name %s already exists", udCheck)
 		}
 
-		return out.String(), chartutil.ExpandFile(ud, saved)
+		opts := archive.DefaultOptions
+		if p.MaxChartSize > 0 {
+			opts.MaxDecompressedChartSize = p.MaxChartSize
+		}
+		if p.MaxChartFileSize > 0 {
+			opts.MaxDecompressedFileSize = p.MaxChartFileSize
+		}
+		return out.String(), chartutil.ExpandFileWithOptions(ud, saved, opts)
 	}
 	return out.String(), nil
 }

pkg/action/upgrade.go

@@ -129,6 +129,10 @@ type Upgrade struct {
 	EnableDNS bool
 	// TakeOwnership will skip the check for helm annotations and adopt all existing resources.
 	TakeOwnership bool
+	// MaxChartSize is the maximum decompressed size of a chart in bytes
+	MaxChartSize int64
+	// MaxChartFileSize is the maximum size of a single file in a chart in bytes
+	MaxChartFileSize int64
 }
 
 type resultMessage struct {

pkg/chart/loader/archive/archive.go

@@ -32,15 +32,6 @@ import (
 	"time"
 )
 
-// MaxDecompressedChartSize is the maximum size of a chart archive that will be
-// decompressed. This is the decompressed size of all the files.
-// The default value is 100 MiB.
-var MaxDecompressedChartSize int64 = 100 * 1024 * 1024 // Default 100 MiB
-
-// MaxDecompressedFileSize is the size of the largest file that Helm will attempt to load.
-// The size of the file is the decompressed version of it when it is stored in an archive.
-var MaxDecompressedFileSize int64 = 5 * 1024 * 1024 // Default 5 MiB
-
 var drivePathPattern = regexp.MustCompile(`^[a-zA-Z]:/`)
 
 var utf8bom = []byte{0xEF, 0xBB, 0xBF}
@@ -52,10 +43,33 @@ type BufferedFile struct {
 	Data    []byte
 }
 
+// Options controls archive loading limits.
+type Options struct {
+	// MaxDecompressedChartSize is the maximum size of a chart archive that will be
+	// decompressed. This is the decompressed size of all the files.
+	MaxDecompressedChartSize int64
+	// MaxDecompressedFileSize is the size of the largest file that Helm will attempt to load.
+	// The size of the file is the decompressed version of it when it is stored in an archive.
+	MaxDecompressedFileSize int64
+}
+
+// DefaultOptions provides the default size limits used when loading archives.
+var DefaultOptions = Options{
+	MaxDecompressedChartSize: 100 * 1024 * 1024, // 100 MiB
+	MaxDecompressedFileSize:  5 * 1024 * 1024,   // 5 MiB
+}
+
 // LoadArchiveFiles reads in files out of an archive into memory. This function
 // performs important path security checks and should always be used before
-// expanding a tarball
+// expanding a tarball. It use default options.
 func LoadArchiveFiles(in io.Reader) ([]*BufferedFile, error) {
+	return LoadArchiveFilesWithOptions(in, DefaultOptions)
+}
+
+// LoadArchiveFiles reads in files out of an archive into memory. This function
+// performs important path security checks and should always be used before
+// expanding a tarball. It uses the provided options.
+func LoadArchiveFilesWithOptions(in io.Reader, opts Options) ([]*BufferedFile, error) {
 	unzipped, err := gzip.NewReader(in)
 	if err != nil {
 		return nil, err
@@ -64,7 +78,7 @@ func LoadArchiveFiles(in io.Reader) ([]*BufferedFile, error) {
 
 	files := []*BufferedFile{}
 	tr := tar.NewReader(unzipped)
-	remainingSize := MaxDecompressedChartSize
+	remainingSize := opts.MaxDecompressedChartSize
 	for {
 		b := bytes.NewBuffer(nil)
 		hd, err := tr.Next()
@@ -125,11 +139,11 @@ func LoadArchiveFiles(in io.Reader) ([]*BufferedFile, error) {
 		}
 
 		if hd.Size > remainingSize {
-			return nil, fmt.Errorf("decompressed chart is larger than the maximum size %d", MaxDecompressedChartSize)
+			return nil, fmt.Errorf("decompressed chart is larger than the maximum size %d bytes", opts.MaxDecompressedChartSize)
 		}
 
-		if hd.Size > MaxDecompressedFileSize {
-			return nil, fmt.Errorf("decompressed chart file %q is larger than the maximum file size %d", hd.Name, MaxDecompressedFileSize)
+		if hd.Size > opts.MaxDecompressedFileSize {
+			return nil, fmt.Errorf("decompressed chart file %q is larger than the maximum file size %d bytes", hd.Name, opts.MaxDecompressedFileSize)
 		}
 
 		limitedReader := io.LimitReader(tr, remainingSize)
@@ -145,7 +159,7 @@ func LoadArchiveFiles(in io.Reader) ([]*BufferedFile, error) {
 		// is the one that goes over the limit. It assumes the Size stored in the tar header
 		// is correct, something many applications do.
 		if bytesWritten < hd.Size || remainingSize <= 0 {
-			return nil, fmt.Errorf("decompressed chart is larger than the maximum size %d", MaxDecompressedChartSize)
+			return nil, fmt.Errorf("decompressed chart is larger than the maximum size %d bytes", opts.MaxDecompressedChartSize)
 		}
 
 		data := bytes.TrimPrefix(b.Bytes(), utf8bom)

pkg/chart/loader/load.go

@@ -37,6 +37,7 @@ import (
 // ChartLoader loads a chart.
 type ChartLoader interface {
 	Load() (chart.Charter, error)
+	LoadWithOptions() (chart.Charter, error)
 }
 
 // Loader returns a new ChartLoader appropriate for the given chart name
@@ -46,9 +47,31 @@ func Loader(name string) (ChartLoader, error) {
 		return nil, err
 	}
 	if fi.IsDir() {
-		return DirLoader(name), nil
+		return NewDefaultDirLoader(name), nil
 	}
-	return FileLoader(name), nil
+	return NewDefaultFileLoader(name), nil
+}
+
+// WithOptions returns a new ChartLoader appropriate for the given chart name
+// with the provided options.
+func WithOptions(name string, opts archive.Options) (ChartLoader, error) {
+	fi, err := os.Stat(name)
+	if err != nil {
+		return nil, err
+	}
+	if fi.IsDir() {
+		return NewDirLoader(name, opts), nil
+	}
+	return NewFileLoader(name, opts), nil
+}
+
+// LoadWithOptions takes a string name, resolves it to a file or directory, and loads it with custom options.
+func LoadWithOptions(name string, opts archive.Options) (chart.Charter, error) {
+	l, err := WithOptions(name, opts)
+	if err != nil {
+		return nil, err
+	}
+	return l.LoadWithOptions()
 }
 
 // Load takes a string name, tries to resolve it to a file or directory, and then loads it.
@@ -67,14 +90,36 @@ func Load(name string) (chart.Charter, error) {
 }
 
 // DirLoader loads a chart from a directory
-type DirLoader string
+type DirLoader struct {
+	path string
+	opts archive.Options
+}
+
+// NewDefaultDirLoader creates a new directory loader with default options
+func NewDefaultDirLoader(path string) DirLoader {
+	return DirLoader{path: path, opts: archive.DefaultOptions}
+}
+
+// NewDirLoader creates a new directory loader with custom options
+func NewDirLoader(path string, opts archive.Options) DirLoader {
+	return DirLoader{path: path, opts: opts}
+}
 
 // Load loads the chart
 func (l DirLoader) Load() (chart.Charter, error) {
-	return LoadDir(string(l))
+	return LoadDir(l.path)
+}
+
+// LoadWithOptions loads the chart with custom options
+func (l DirLoader) LoadWithOptions() (chart.Charter, error) {
+	return LoadDirWithOptions(l.path, l.opts)
 }
 
 func LoadDir(dir string) (chart.Charter, error) {
+	return LoadDirWithOptions(dir, archive.DefaultOptions)
+}
+
+func LoadDirWithOptions(dir string, opts archive.Options) (chart.Charter, error) {
 	topdir, err := filepath.Abs(dir)
 	if err != nil {
 		return nil, err
@@ -94,24 +139,46 @@ func LoadDir(dir string) (chart.Charter, error) {
 
 	switch c.APIVersion {
 	case c2.APIVersionV1, c2.APIVersionV2, "":
-		return c2load.Load(dir)
+		return c2load.LoadWithOptions(dir, opts)
 	case c3.APIVersionV3:
-		return c3load.Load(dir)
+		return c3load.LoadWithOptions(dir, opts)
 	default:
 		return nil, errors.New("unsupported chart version")
 	}
 
 }
 
-// FileLoader loads a chart from a file
-type FileLoader string
+// FileLoader with embedded options
+type FileLoader struct {
+	path string
+	opts archive.Options
+}
+
+// NewFileLoader creates a file loader with custom options
+func NewFileLoader(path string, opts archive.Options) FileLoader {
+	return FileLoader{path: path, opts: opts}
+}
+
+// NewDefaultFileLoader creates a file loader with default options
+func NewDefaultFileLoader(path string) FileLoader {
+	return FileLoader{path: path, opts: archive.DefaultOptions}
+}
 
-// Load loads a chart
+// Load loads a chart with default options
 func (l FileLoader) Load() (chart.Charter, error) {
-	return LoadFile(string(l))
+	return LoadFileWithOptions(l.path, archive.DefaultOptions)
+}
+
+// LoadWithOptions loads a chart with custom options
+func (l FileLoader) LoadWithOptions() (chart.Charter, error) {
+	return LoadFileWithOptions(l.path, l.opts)
 }
 
 func LoadFile(name string) (chart.Charter, error) {
+	return LoadFileWithOptions(name, archive.DefaultOptions)
+}
+
+func LoadFileWithOptions(name string, opts archive.Options) (chart.Charter, error) {
 	if fi, err := os.Stat(name); err != nil {
 		return nil, err
 	} else if fi.IsDir() {
@@ -129,12 +196,12 @@ func LoadFile(name string) (chart.Charter, error) {
 		return nil, err
 	}
 
-	files, err := archive.LoadArchiveFiles(raw)
+	files, err := archive.LoadArchiveFilesWithOptions(raw, opts)
 	if err != nil {
 		if err == gzip.ErrHeader {
 			return nil, fmt.Errorf("file '%s' does not appear to be a valid chart file (details: %s)", name, err)
 		}
-		return nil, errors.New("unable to load chart archive")
+		return nil, fmt.Errorf("unable to load chart archive: %w", err)
 	}
 
 	for _, f := range files {
@@ -145,9 +212,9 @@ func LoadFile(name string) (chart.Charter, error) {
 			}
 			switch c.APIVersion {
 			case c2.APIVersionV1, c2.APIVersionV2, "":
-				return c2load.Load(name)
+				return c2load.LoadWithOptions(name, opts)
 			case c3.APIVersionV3:
-				return c3load.Load(name)
+				return c3load.LoadWithOptions(name, opts)
 			default:
 				return nil, errors.New("unsupported chart version")
 			}

pkg/chart/v2/loader/archive.go

@@ -37,6 +37,11 @@ func (l FileLoader) Load() (*chart.Chart, error) {
 
 // LoadFile loads from an archive file.
 func LoadFile(name string) (*chart.Chart, error) {
+	return LoadFileWithOptions(name, archive.DefaultOptions)
+}
+
+// LoadFileWithOptions loads from an archive file using the provided options.
+func LoadFileWithOptions(name string, opts archive.Options) (*chart.Chart, error) {
 	if fi, err := os.Stat(name); err != nil {
 		return nil, err
 	} else if fi.IsDir() {
@@ -54,7 +59,7 @@ func LoadFile(name string) (*chart.Chart, error) {
 		return nil, err
 	}
 
-	c, err := LoadArchive(raw)
+	c, err := LoadArchiveWithOptions(raw, opts)
 	if err != nil {
 		if err == gzip.ErrHeader {
 			return nil, fmt.Errorf("file '%s' does not appear to be a valid chart file (details: %s)", name, err)
@@ -65,10 +70,14 @@ func LoadFile(name string) (*chart.Chart, error) {
 
 // LoadArchive loads from a reader containing a compressed tar archive.
 func LoadArchive(in io.Reader) (*chart.Chart, error) {
-	files, err := archive.LoadArchiveFiles(in)
+	return LoadArchiveWithOptions(in, archive.DefaultOptions)
+}
+
+// LoadArchiveWithOptions loads from a reader containing a compressed tar archive using the provided options.
+func LoadArchiveWithOptions(in io.Reader, opts archive.Options) (*chart.Chart, error) {
+	files, err := archive.LoadArchiveFilesWithOptions(in, opts)
 	if err != nil {
 		return nil, err
 	}
-
 	return LoadFiles(files)
 }

pkg/chart/v2/loader/directory.go

@@ -43,6 +43,11 @@ func (l DirLoader) Load() (*chart.Chart, error) {
 //
 // This loads charts only from directories.
 func LoadDir(dir string) (*chart.Chart, error) {
+	return LoadDirWithOptions(dir, archive.DefaultOptions)
+}
+
+// LoadDirWithOptions loads from a directory using the provided options.
+func LoadDirWithOptions(dir string, opts archive.Options) (*chart.Chart, error) {
 	topdir, err := filepath.Abs(dir)
 	if err != nil {
 		return nil, err
@@ -100,8 +105,8 @@ func LoadDir(dir string) (*chart.Chart, error) {
 			return fmt.Errorf("cannot load irregular file %s as it has file mode type bits set", name)
 		}
 
-		if fi.Size() > archive.MaxDecompressedFileSize {
-			return fmt.Errorf("chart file %q is larger than the maximum file size %d", fi.Name(), archive.MaxDecompressedFileSize)
+		if fi.Size() > opts.MaxDecompressedFileSize {
+			return fmt.Errorf("chart file %q is larger than the maximum file size %d", fi.Name(), opts.MaxDecompressedFileSize)
 		}
 
 		data, err := os.ReadFile(name)

pkg/chart/v2/loader/load.go

@@ -61,11 +61,19 @@ func Loader(name string) (ChartLoader, error) {
 // If a .helmignore file is present, the directory loader will skip loading any files
 // matching it. But .helmignore is not evaluated when reading out of an archive.
 func Load(name string) (*chart.Chart, error) {
-	l, err := Loader(name)
+	return LoadWithOptions(name, archive.DefaultOptions)
+}
+
+// LoadWithOptions takes a string name, resolves it to a file or directory, and loads it with custom options.
+func LoadWithOptions(name string, opts archive.Options) (*chart.Chart, error) {
+	fi, err := os.Stat(name)
 	if err != nil {
 		return nil, err
 	}
-	return l.Load()
+	if fi.IsDir() {
+		return LoadDirWithOptions(name, opts)
+	}
+	return LoadFileWithOptions(name, opts)
 }
 
 // LoadFiles loads from in-memory files.

pkg/chart/v2/util/expand.go

@@ -30,9 +30,14 @@ import (
 	chart "helm.sh/helm/v4/pkg/chart/v2"
 )
 
-// Expand uncompresses and extracts a chart into the specified directory.
+// Expand uncompresses and extracts a chart into the specified directory using default options.
 func Expand(dir string, r io.Reader) error {
-	files, err := archive.LoadArchiveFiles(r)
+	return ExpandWithOptions(dir, r, archive.DefaultOptions)
+}
+
+// ExpandWithOptions uncompresses and extracts a chart into the specified directory using the provided options.
+func ExpandWithOptions(dir string, r io.Reader, opts archive.Options) error {
+	files, err := archive.LoadArchiveFilesWithOptions(r, opts)
 	if err != nil {
 		return err
 	}
@@ -83,12 +88,17 @@ func Expand(dir string, r io.Reader) error {
 	return nil
 }
 
-// ExpandFile expands the src file into the dest directory.
+// ExpandFile expands the src file into the dest directory using default options.
 func ExpandFile(dest, src string) error {
+	return ExpandFileWithOptions(dest, src, archive.DefaultOptions)
+}
+
+// ExpandFileWithOptions expands the src file into the dest directory using the provided options.
+func ExpandFileWithOptions(dest, src string, opts archive.Options) error {
 	h, err := os.Open(src)
 	if err != nil {
 		return err
 	}
 	defer h.Close()
-	return Expand(dest, h)
+	return ExpandWithOptions(dest, h, opts)
 }

pkg/cli/environment.go

@@ -93,6 +93,10 @@ type EnvSettings struct {
 	ColorMode string
 	// ContentCache is the location where cached charts are stored
 	ContentCache string
+	// MaxChartSize is the maximum size of a decompressed chart in bytes
+	MaxChartSize int64
+	// MaxChartFileSize is the maximum size of a single file in a chart in bytes
+	MaxChartFileSize int64
 }
 
 func New() *EnvSettings {
@@ -115,6 +119,8 @@ func New() *EnvSettings {
 		BurstLimit:                envIntOr("HELM_BURST_LIMIT", defaultBurstLimit),
 		QPS:                       envFloat32Or("HELM_QPS", defaultQPS),
 		ColorMode:                 envColorMode(),
+		MaxChartSize:              envInt64Or("HELM_MAX_CHART_SIZE", 100*1024*1024), // 100 MiB
+		MaxChartFileSize:          envInt64Or("HELM_MAX_FILE_SIZE", 5*1024*1024),    // 5 MiB
 	}
 	env.Debug, _ = strconv.ParseBool(os.Getenv("HELM_DEBUG"))
 
@@ -214,6 +220,20 @@ func envFloat32Or(name string, def float32) float32 {
 	return float32(ret)
 }
 
+// We want to handle int64 like returned by https://pkg.go.dev/io/fs#FileInfo
+func envInt64Or(name string, def int64) int64 {
+	if name == "" {
+		return def
+	}
+	envVal := envOr(name, strconv.FormatInt(def, 10))
+	ret, err := strconv.ParseInt(envVal, 10, 64)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Warning: Environment variable %s has invalid value %q (expected an integer): %v\n", name, envVal, err)
+		return def
+	}
+	return ret
+}
+
 func envCSV(name string) (ls []string) {
 	trimmed := strings.Trim(os.Getenv(name), ", ")
 	if trimmed != "" {
@@ -255,6 +275,8 @@ func (s *EnvSettings) EnvVars() map[string]string {
 		"HELM_MAX_HISTORY":       strconv.Itoa(s.MaxHistory),
 		"HELM_BURST_LIMIT":       strconv.Itoa(s.BurstLimit),
 		"HELM_QPS":               strconv.FormatFloat(float64(s.QPS), 'f', 2, 32),
+		"HELM_MAX_CHART_SIZE":    strconv.FormatInt(s.MaxChartSize, 10),
+		"HELM_MAX_FILE_SIZE":     strconv.FormatInt(s.MaxChartFileSize, 10),
 
 		// broken, these are populated from helm flags and not kubeconfig.
 		"HELM_KUBECONTEXT":                  s.KubeContext,

pkg/cli/environment_test.go

@@ -242,6 +242,59 @@ func TestEnvOrBool(t *testing.T) {
 	}
 }
 
+func TestEnvInt64Or(t *testing.T) {
+	envName := "TEST_ENV_INT64"
+
+	tests := []struct {
+		name     string
+		env      string
+		val      string
+		def      int64
+		expected int64
+	}{
+		{
+			name:     "empty env with default",
+			env:      "",
+			val:      "",
+			def:      100,
+			expected: 100,
+		},
+		{
+			name:     "env set with valid int64",
+			env:      envName,
+			val:      "12345",
+			def:      100,
+			expected: 12345,
+		},
+		{
+			name:     "env fails parsing with default",
+			env:      envName,
+			val:      "NOT_A_NUMBER",
+			def:      100,
+			expected: 100,
+		},
+		{
+			name:     "env empty string with default",
+			env:      envName,
+			val:      "",
+			def:      200,
+			expected: 200,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.env != "" {
+				t.Setenv(tt.env, tt.val)
+			}
+			actual := envInt64Or(tt.env, tt.def)
+			if actual != tt.expected {
+				t.Errorf("expected result %d, got %d", tt.expected, actual)
+			}
+		})
+	}
+}
+
 func TestUserAgentHeaderInK8sRESTClientConfig(t *testing.T) {
 	defer resetEnv()()
 

pkg/cmd/install.go

@@ -33,6 +33,7 @@ import (
 	"helm.sh/helm/v4/pkg/action"
 	"helm.sh/helm/v4/pkg/chart"
 	"helm.sh/helm/v4/pkg/chart/loader"
+	"helm.sh/helm/v4/pkg/chart/loader/archive"
 	"helm.sh/helm/v4/pkg/cli/output"
 	"helm.sh/helm/v4/pkg/cli/values"
 	"helm.sh/helm/v4/pkg/cmd/require"
@@ -179,6 +180,8 @@ func newInstallCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 	addDryRunFlag(cmd)
 	bindOutputFlag(cmd, &outfmt)
 	bindPostRenderFlag(cmd, &client.PostRenderer, settings)
+	f.Int64Var(&client.MaxChartSize, "max-chart-size", settings.MaxChartSize, "maximum size in bytes for a decompressed chart (default is 100mb)")
+	f.Int64Var(&client.MaxChartFileSize, "max-file-size", settings.MaxChartFileSize, "maximum size in bytes for a single file in a chart (default is 5mb)")
 
 	return cmd
 }
@@ -256,8 +259,16 @@ func runInstall(args []string, client *action.Install, valueOpts *values.Options
 		return nil, err
 	}
 
+	opts := archive.DefaultOptions
+	if client.MaxChartSize > 0 {
+		opts.MaxDecompressedChartSize = client.MaxChartSize
+	}
+	if client.MaxChartFileSize > 0 {
+		opts.MaxDecompressedFileSize = client.MaxChartFileSize
+	}
+
 	// Check chart dependencies to make sure all are present in /charts
-	chartRequested, err := loader.Load(cp)
+	chartRequested, err := loader.LoadWithOptions(cp, opts)
 	if err != nil {
 		return nil, err
 	}

pkg/cmd/install_test.go

@@ -274,6 +274,12 @@ func TestInstall(t *testing.T) {
 			wantError: true,
 			golden:    "output/install-hide-secret.txt",
 		},
+		{
+			name:      "install with restricted max size",
+			cmd:       "install too-big testdata/testcharts/compressedchart-0.1.0.tgz --max-chart-size=42",
+			wantError: true,
+			golden:    "output/install-with-restricted-chart-size.txt",
+		},
 	}
 
 	runTestCmd(t, tests)

pkg/cmd/pull.go

@@ -89,6 +89,8 @@ func newPullCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 	f.BoolVar(&client.VerifyLater, "prov", false, "fetch the provenance file, but don't perform verification")
 	f.StringVar(&client.UntarDir, "untardir", ".", "if untar is specified, this flag specifies the name of the directory into which the chart is expanded")
 	f.StringVarP(&client.DestDir, "destination", "d", ".", "location to write the chart. If this and untardir are specified, untardir is appended to this")
+	f.Int64Var(&client.MaxChartSize, "max-chart-size", settings.MaxChartSize, "maximum size in bytes for a decompressed chart (default is 100mb)")
+	f.Int64Var(&client.MaxChartFileSize, "max-file-size", settings.MaxChartFileSize, "maximum size in bytes for a single file in a chart (default is 5mb)")
 	addChartPathOptionsFlags(f, &client.ChartPathOptions)
 
 	err := cmd.RegisterFlagCompletionFunc("version", func(_ *cobra.Command, args []string, toComplete string) ([]string, cobra.ShellCompDirective) {

pkg/cmd/pull_test.go

@@ -210,6 +210,12 @@ func TestPullCmd(t *testing.T) {
 			wantErrorMsg: "chart reference and version mismatch: 0.1.0 is not 0.2.0",
 			wantError:    true,
 		},
+		{
+			name:         "Fail because of small max chart size",
+			args:         "test/test1 --max-chart-size=90",
+			wantError:    true,
+			wantErrorMsg: "decompressed chart is larger than the maximum size 90 bytes",
+		},
 	}
 
 	contentCache := t.TempDir()

pkg/cmd/root.go

@@ -84,6 +84,8 @@ Environment variables:
 | $HELM_QPS                          | set the Queries Per Second in cases where a high number of calls exceed the option for higher burst values |
 | $HELM_COLOR                        | set color output mode. Allowed values: never, always, auto (default: never)                                |
 | $NO_COLOR                          | set to any non-empty value to disable all colored output (overrides $HELM_COLOR)                           |
+| $HELM_MAX_CHART_SIZE               | set the maximum size in bytes for a decompressed chart (default: 100MiB, 0 means use default limit)        |
+| $HELM_MAX_FILE_SIZE                | set the maximum size in bytes for a single file in a chart (default: 5MiB, 0 means use default limit)      |
 
 Helm stores cache, configuration, and data based on the following configuration order:
 

pkg/cmd/testdata/output/env-comp.txt

@@ -13,6 +13,8 @@ HELM_KUBECONTEXT
 HELM_KUBEINSECURE_SKIP_TLS_VERIFY
 HELM_KUBETLS_SERVER_NAME
 HELM_KUBETOKEN
+HELM_MAX_CHART_SIZE
+HELM_MAX_FILE_SIZE
 HELM_MAX_HISTORY
 HELM_NAMESPACE
 HELM_PLUGINS

pkg/cmd/testdata/output/install-with-restricted-chart-size.txt

@@ -0,0 +1 @@
+Error: INSTALLATION FAILED: unable to load chart archive: decompressed chart is larger than the maximum size 42 bytes

pkg/cmd/testdata/output/upgrade-failed-max-chart-size.txt

@@ -0,0 +1 @@
+Error: unable to load chart archive: decompressed chart is larger than the maximum size 52 bytes

pkg/cmd/upgrade.go

@@ -32,6 +32,7 @@ import (
 	"helm.sh/helm/v4/pkg/action"
 	ci "helm.sh/helm/v4/pkg/chart"
 	"helm.sh/helm/v4/pkg/chart/loader"
+	"helm.sh/helm/v4/pkg/chart/loader/archive"
 	"helm.sh/helm/v4/pkg/cli/output"
 	"helm.sh/helm/v4/pkg/cli/values"
 	"helm.sh/helm/v4/pkg/cmd/require"
@@ -190,8 +191,16 @@ func newUpgradeCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 				return err
 			}
 
+			opts := archive.DefaultOptions
+			if client.MaxChartSize > 0 {
+				opts.MaxDecompressedChartSize = client.MaxChartSize
+			}
+			if client.MaxChartFileSize > 0 {
+				opts.MaxDecompressedFileSize = client.MaxChartFileSize
+			}
+
 			// Check chart dependencies to make sure all are present in /charts
-			ch, err := loader.Load(chartPath)
+			ch, err := loader.LoadWithOptions(chartPath, opts)
 			if err != nil {
 				return err
 			}
@@ -219,7 +228,7 @@ func newUpgradeCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 							return err
 						}
 						// Reload the chart with the updated Chart.lock file.
-						if ch, err = loader.Load(chartPath); err != nil {
+						if ch, err = loader.LoadWithOptions(chartPath, opts); err != nil {
 							return fmt.Errorf("failed reloading chart after repo update: %w", err)
 						}
 					} else {
@@ -297,6 +306,8 @@ func newUpgradeCmd(cfg *action.Configuration, out io.Writer) *cobra.Command {
 	f.BoolVar(&client.DependencyUpdate, "dependency-update", false, "update dependencies if they are missing before installing the chart")
 	f.BoolVar(&client.EnableDNS, "enable-dns", false, "enable DNS lookups when rendering templates")
 	f.BoolVar(&client.TakeOwnership, "take-ownership", false, "if set, upgrade will ignore the check for helm annotations and take ownership of the existing resources")
+	f.Int64Var(&client.MaxChartSize, "max-chart-size", settings.MaxChartSize, "maximum size in bytes for a decompressed chart (default is 100mb)")
+	f.Int64Var(&client.MaxChartFileSize, "max-file-size", settings.MaxChartFileSize, "maximum size in bytes for a single file in a chart (default is 5mb)")
 	addDryRunFlag(cmd)
 	addChartPathOptionsFlags(f, &client.ChartPathOptions)
 	addValueOptionsFlags(f, valueOpts)

pkg/cmd/upgrade_test.go

@@ -83,6 +83,7 @@ func TestUpgradeCmd(t *testing.T) {
 	missingDepsPath := "testdata/testcharts/chart-missing-deps"
 	badDepsPath := "testdata/testcharts/chart-bad-requirements"
 	presentDepsPath := "testdata/testcharts/chart-with-subchart-update"
+	compressedPath := "testdata/testcharts/compressedchart-0.1.0.tgz"
 
 	relWithStatusMock := func(n string, v int, ch *chart.Chart, status rcommon.Status) *release.Release {
 		return release.Mock(&release.MockReleaseOptions{Name: n, Version: v, Chart: ch, Status: status})
@@ -190,6 +191,12 @@ func TestUpgradeCmd(t *testing.T) {
 			golden: "output/upgrade-uninstalled-with-keep-history.txt",
 			rels:   []*release.Release{relWithStatusMock("funny-bunny", 2, ch, rcommon.StatusUninstalled)},
 		},
+		{
+			name:      "upgrade with restricted max size",
+			cmd:       fmt.Sprintf("upgrade too-big '%s' --max-chart-size=52", compressedPath),
+			wantError: true,
+			golden:    "output/upgrade-failed-max-chart-size.txt",
+		},
 	}
 	runTestCmd(t, tests)
 }