5 ms·
To be fair, people wanting to do that don't need author to have create a zip bomber, they can do it by themselves. Actually, I don't see how to defend this. Is
by oelmekki 9y ago
To be fair, people wanting to do that don't need author to have create a zip bomber, they can do it by themselves.
Actually, I don't see how to defend this. Is there any way to ask a gzip file which size it will be once unzipped, without needing to decompress it?
- Qantourisc 9y agoYes, but your decompression middle ware might need an update/change: When you ask for a decompress, you specify the max size (if you are asking it to decompress everything).
- halomru 9y ago>Is there any way to ask a gzip file which size it will be once unzipped, without needing to decompress it? The closest is uncompressing it and counting and immediately discarding the bytes in the output stream. But of course the proper defense is to give up if you exceed a predefined memory or time budget.
- c3833174 9y agoDecompress it in chunks and stop when a preset limit is reached.
- danesparza 9y agoI think this is exactly what the HTTP 'HEAD' verb is for: https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/HEAD https://developer.mozilla.org/en-US/docs/Web/HTTP/Methods/HE...
- oelmekki 9y agoWouldn't a HEAD give the size of the zipped content, and not the size of the content once decompressed?
- danesparza 9y agoThis is a great question. I'm actually not sure, since gzip encoding/decoding is built-in to several webservers and browsers.