Check inputs to java.util.ZipInputStream for cases that cause consumption of excessive system resources. Denial of service can occur when resource usage is disproportionately large in comparison to the input data that causes the resource usage. The nature of the zip algorithm permits the existence of "zip bombs" whereby a short file is very highly compressed, for instance, such as ZIPs, GIFs, and gzip encoded HTTP content.
| Wiki Markup |
|---|
The zip algorithm is capable of producing very large compression ratios \[[Mahmoud 2002|AA. Bibliography#Mahmoud 02]\]. The example below shows a file that was compressed from 148MB to 590KB, a ratio of more than 200 to 1. The file consists of arbitrarily repeated data: alternating lines of 'a' characters and 'b' characters. Even higher compression ratios can be easily obtained using more input data, more targeted input data, and other compression methods. |
Any entry in a Zip file whose uncompressed file size is beyond a certain limit must not be uncompressed. The actual limit is dependent on the capabilities of the platform.
...
In this compliant solution, the code inside the while loop uses the ZipEntry.getSize() to find the uncompressed filesize file size of each entry in a zip archive before extracting the entry. It throws an exception if the entry to be extracted is too large — 100MB in this case.
...
Related Guidelines
CWE ID -409, "Improper Handling of Highly Compressed Data (Data Amplification)" | |
Secure Coding Guidelines for the Java Programming Language, Version 3.0 | Guideline 2-5 Check that inputs do not cause excessive resource consumption |
Bibliography
<ac:structured-macro ac:name="unmigrated-wiki-markup" ac:schema-version="1" ac:macro-id="37e97127-6e1b-4824-86f4-179abecd1815"><ac:plain-text-body><![CDATA[ | [[Mahmoud 2002 | AA. Bibliography#Mahmoud 02]] | [Compressing and Decompressing Data Using Java APIs | http://java.sun.com/developer/technicalArticles/Programming/compression/] | ]]></ac:plain-text-body></ac:structured-macro> |
...
IDS04-J. Do not log unsanitized user input IDS06-J. Use a subset of ASCII for file and path names