How can I protect myself from a zip bomb?

Question

I just read about zip bombs, i.e. zip files that contain very large amount of highly compressible data (00000000000000000...).

When opened they fill the server's disk.

How can I detect a zip file is a zip bomb before unzipping it?

UPDATE Can you tell me how is this done in Python or Java?

Answer 1

Try this in Python:

import zipfile  with zipfile.ZipFile('a_file.zip') as z     print(f'total files size={sum(e.file_size for e in z.infolist())}') 

Answer 2

Zip is, erm, an "interesting" format. A robust solution is to stream the data out, and stop when you have had enough. In Java, use ZipInputStream rather than ZipFile. The latter also requires you to store the data in a temporary file, which is also not the greatest of ideas.