question-mark
Stuck on an issue?

Lightrun Answers was designed to reduce the constant googling that comes with debugging 3rd party libraries. It collects links to all the places you might be looking at while hunting down a tough bug.

And, if you’re still stuck at the end, we’re happy to hop on a call to see how we can help out.

ZipBombException for valid maps

See original GitHub issue

Some map file downloads don’t work because of a ZipBombException.

According to https://github.com/FAForever/faf-java-api/issues/326, a ZipBombException occurs if the extracted file is more than 100x larger than the zip file. Unfortunately, this seems to be the case for some real maps.

To Reproduce Download an affected map from the vault, e.g. crazyrush.v0003. https://content.faforever.com/faf/vault/maps/crazyrush.v0003.zip (10KB; expands to 1.3MB)

OS Windows

Issue Analytics

  • State:closed
  • Created 4 years ago
  • Comments:7 (7 by maintainers)

github_iconTop GitHub Comments

1reaction
Brutus5000commented, Nov 23, 2019

@axel1200 No, we should adjust the parameters, so it fires not so early. The question is, what are the right ones. Maybe 20MB rather than 1MB?

0reactions
1-alex98commented, Dec 9, 2019

Nobody can upload these kind of maps any longer, but it only happens if ppl upload maps that are monotonic, those are incompatible with the map vault rules anyway. This is actually pretty funny because the ZIP BOMB check enforces the map vault rules as a side effect. The rule says use more than three textures

Read more comments on GitHub >

github_iconTop Results From Across the Web

Using Apache POI - Zip Bomb detected - Stack Overflow
The workaround is to add this line before you open the workbook: ZipSecureFile.setMinInflateRatio(0);.
Read more >
Java static code analysis
A Zip bomb is usually a malicious archive file of a few kilobytes of compressed data but turned into gigabytes of uncompressed data....
Read more >
Defending a website with Zip bombs - Hacker News
The scan is an intent to transmit malware. If that's true, you could make a pretty good fleeing felon argument.
Read more >
58499 – ZipSecureFile throws zip bomb detected
When using 3.13 SXSSFWorkbook fails with exception java.io.IOException: Zip bomb detected! The file would exceed certain limits which ...
Read more >
ZBLG: non-recursive zip bomb with a 28000000:1 ratio - Reddit
Search, Maps, etc. Facebook doesn't really offer anything useful. It's just a social network like any other, hell it probably even makes ...
Read more >

github_iconTop Related Medium Post

No results found

github_iconTop Related StackOverflow Question

No results found

github_iconTroubleshoot Live Code

Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start Free

github_iconTop Related Reddit Thread

No results found

github_iconTop Related Hackernoon Post

No results found

github_iconTop Related Tweet

No results found

github_iconTop Related Dev.to Post

No results found

github_iconTop Related Hashnode Post

No results found