3 ms·
I think it's meant in the sense of "can detect the exploits without having to actually attempt decompressing anything"
by frabert 4y ago
I think it's meant in the sense of "can detect the exploits without having to actually attempt decompressing anything"
- _vvhw 4y agoExactly, although, at present, Pure will also do dynamic analysis on the compressed stream once the metadata checks out, to verify that the compressed stream checks out with the metadata, i.e. that there's no semantic gap between the designated size and the actual stream size. This guards against one category of ZIP bomb.