ZipBombException for valid maps
See original GitHub issueSome map file downloads don’t work because of a ZipBombException.
According to https://github.com/FAForever/faf-java-api/issues/326, a ZipBombException occurs if the extracted file is more than 100x larger than the zip file. Unfortunately, this seems to be the case for some real maps.
To Reproduce
Download an affected map from the vault, e.g. crazyrush.v0003
.
https://content.faforever.com/faf/vault/maps/crazyrush.v0003.zip
(10KB; expands to 1.3MB)
OS Windows
Issue Analytics
- State:
- Created 4 years ago
- Comments:7 (7 by maintainers)
Top Results From Across the Web
Using Apache POI - Zip Bomb detected - Stack Overflow
The workaround is to add this line before you open the workbook: ZipSecureFile.setMinInflateRatio(0);.
Read more >Java static code analysis
A Zip bomb is usually a malicious archive file of a few kilobytes of compressed data but turned into gigabytes of uncompressed data....
Read more >Defending a website with Zip bombs - Hacker News
The scan is an intent to transmit malware. If that's true, you could make a pretty good fleeing felon argument.
Read more >58499 – ZipSecureFile throws zip bomb detected
When using 3.13 SXSSFWorkbook fails with exception java.io.IOException: Zip bomb detected! The file would exceed certain limits which ...
Read more >ZBLG: non-recursive zip bomb with a 28000000:1 ratio - Reddit
Search, Maps, etc. Facebook doesn't really offer anything useful. It's just a social network like any other, hell it probably even makes ...
Read more >Top Related Medium Post
No results found
Top Related StackOverflow Question
No results found
Troubleshoot Live Code
Lightrun enables developers to add logs, metrics and snapshots to live code - no restarts or redeploys required.
Start FreeTop Related Reddit Thread
No results found
Top Related Hackernoon Post
No results found
Top Related Tweet
No results found
Top Related Dev.to Post
No results found
Top Related Hashnode Post
No results found
Top GitHub Comments
@axel1200 No, we should adjust the parameters, so it fires not so early. The question is, what are the right ones. Maybe 20MB rather than 1MB?
Nobody can upload these kind of maps any longer, but it only happens if ppl upload maps that are monotonic, those are incompatible with the map vault rules anyway. This is actually pretty funny because the ZIP BOMB check enforces the map vault rules as a side effect. The rule says use more than three textures