Protection Against Zip Bombs

[schmijos]

Is there a way to protect against zip bombs? Are there limits where extraction is stopped? Can we configure limits? Can we do that at extraction-time by ourselves?

I cannot find anything about that in the documentation.

[simonoff]

There is no such protections.

[radarek]

What kind of protection would you expect? You can check size of each entry in zip file before unpacking. IMHO It should be sufficient but maybe you see problem here?

[schmijos]

@radarek for the record from #403:

Currently there is no way to safely check how much data the Zip::Entry#extract method will actually extract, because the uncompressed size reported in the zip can be spoofed, and the extraction happens in the method where the caller can't check on its progress.

[jdleesmiller]

^ And for the avoidance of doubt, "Currently" there means "before #403".