From 5f4005996e387985353e9300fd171e0b0045dd1a Mon Sep 17 00:00:00 2001
From: vojkovic <git@vojk.au>
Date: Thu, 20 Aug 2026 14:54:12 +0000
Subject: [PATCH] [fix] preferences: cap zlib decompress

---
 searx/preferences.py |  4 ++--
 searx/webapp.py      | 14 +++++++-------
 2 files changed, 9 insertions(+), 9 deletions(-)

diff --git a/searx/preferences.py b/searx/preferences.py
index edc80f8bd..34066cb71 100644
--- a/searx/preferences.py
+++ b/searx/preferences.py
@@ -6,7 +6,7 @@
 import typing as t
 
 from base64 import urlsafe_b64encode, urlsafe_b64decode
-from zlib import compress, decompress
+from zlib import compress, decompressobj
 from urllib.parse import parse_qs, urlencode
 from collections import OrderedDict
 from collections.abc import Iterable
@@ -517,7 +517,7 @@ class Preferences:
 
     def parse_encoded_data(self, input_data: str):
         """parse (base64) preferences from request (``flask.request.form['preferences']``)"""
-        bin_data = decompress(urlsafe_b64decode(input_data))
+        bin_data = decompressobj().decompress(urlsafe_b64decode(input_data), 16 * 1024)
         dict_data = {}
         for x, y in parse_qs(bin_data.decode('ascii'), keep_blank_values=True).items():
             dict_data[x] = y[0]
diff --git a/searx/webapp.py b/searx/webapp.py
index 3be042ba5..b59bcdc7e 100755
--- a/searx/webapp.py
+++ b/searx/webapp.py
@@ -484,14 +484,14 @@ def pre_request():
         if k not in sxng_request.form:
             sxng_request.form[k] = v
 
-    if sxng_request.form.get('preferences'):
-        preferences.parse_encoded_data(sxng_request.form['preferences'])
-    else:
-        try:
+    try:
+        if sxng_request.form.get('preferences'):
+            preferences.parse_encoded_data(sxng_request.form['preferences'])
+        else:
             preferences.parse_dict(sxng_request.form)
-        except Exception as e:  # pylint: disable=broad-except
-            logger.exception(e, exc_info=True)
-            sxng_request.errors.append(gettext('Invalid settings'))
+    except Exception as e:  # pylint: disable=broad-except
+        logger.exception(e, exc_info=True)
+        sxng_request.errors.append(gettext('Invalid settings'))
 
     # language is defined neither in settings nor in preferences
     # use browser headers