Extracting user uploaded archives without exposing to ZipBombs?
My question is simple: how do I make sure (or prevent) a user from uploading an archive that upon extraction fills the entire disc 开发者_开发技巧space (a so-called ZipBomb)? I am using PHP.
Before extracting your archive, use the PHP Zip library functions to ensure that, when extracted, the contents fall within a total size limit.
For example:
$zip = zip_open('uploaded.zip');
$file = zip_read($zip);
$totalsize = 0;
while ($file) {
$totalsize += zip_entry_filesize($file);
$file = zip_read($zip); // read next file
}
zip_close($zip);
if ($totalsize > SIZE_LIMIT) {
// not allowed!
}
精彩评论