commons-issues mailing list archives

Site index · List index
Message view « Date » · « Thread »
Top « Date » · « Thread »
From "Stefan Bodewig (JIRA)" <j...@apache.org>
Subject [jira] [Commented] (COMPRESS-445) Zip Bomb Detection
Date Wed, 25 Apr 2018 17:57:00 GMT

    [ https://issues.apache.org/jira/browse/COMPRESS-445?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16452773#comment-16452773
] 

Stefan Bodewig commented on COMPRESS-445:
-----------------------------------------

I'd like to look into makingĀ  some more of the compressor streams implement {{InputStreamStatitics}}
so it can be used for tar.gz or tar.xz files as well.

> Zip Bomb Detection
> ------------------
>
>                 Key: COMPRESS-445
>                 URL: https://issues.apache.org/jira/browse/COMPRESS-445
>             Project: Commons Compress
>          Issue Type: Improvement
>          Components: Archivers
>            Reporter: PJ Fanning
>            Priority: Major
>              Labels: zip
>             Fix For: 1.17
>
>         Attachments: InputStreamStatistics.patch.gz
>
>
> It would be a nice feature if ZipFile had support for detecting Zip Bombs.
> Apache Poi has an implementation based on the java util ZipFile but this relies on Reflection
and changes in Java 10 mean this code will not work in that version.
> [https://github.com/apache/poi/blob/trunk/src/ooxml/java/org/apache/poi/openxml4j/util/ZipSecureFile.java]
> One option would be to add equivalent change support in commons-compress and for Poi
to use the commons version.



--
This message was sent by Atlassian JIRA
(v7.6.3#76005)

Mime
View raw message