Question

I’m making a PHP script that retrieve user-given zip files, unzip it, and do some stuff with the files in it, using a ZipArchive object. How can I avoid zip bombs like 42.zip?

Answer 1

Check out zip_entry_filesize: http://php.net/manual/en/function.zip-entry-filesize.php

It should give you the actual size of the uncompressed archive within the .zip file. Here’s an example function provided in a comment on the manual page:

function get_zip_originalsize($filename) {
    $size = 0;
    $resource = zip_open($filename);
    while ($dir_resource = zip_read($resource)) {
        $size += zip_entry_filesize($dir_resource);
    }
    zip_close($resource);

    return $size;
}

$size = get_zip_originalsize('file.zip');
echo "original size: $size bytes\n";