5 pointsby michalc12 hours ago1 comment
  • kardos5 hours ago
    Does this get tripped up on zip bombs?
    • michalcan hour ago
      Short answer is no, not as far as I am aware/can reason about it

      In more detail: so by my understanding there are two techniques in making zip bombs…

      Firstly nested ZIPs that leverage the fact that some unZIP programs recursively extract member files. stream-unzip doesn’t do this (Although you could probably use stream-unzip as a component in a vulnerable recursive ZIP parser if you really wanted to… but that I would argue is not the responsibility of stream-unzip)

      The second technique is overlapping member files, but this depends on them overlapping as defined by the central directory at the end of the ZIP, which stream-unzip does not use

      But if you are accepting files from an untrusted source, then you should validate the size of the uncompressed data as you unZIP (which you can do as you validate along with any other properties of the data)