The fix, in one snippet
unzip -l bomb.zip | tail -1Illustrative values. Change the paths, hostnames and options to match your own site before using it.
The sections below explain what is tested, why it matters and the alternatives.
What we test
For zip files the scanner reads the central directory and sums the declared uncompressed sizes, then compares with the file size. A ratio above 100:1 is medium severity; above 1000:1, or a declared total over a gigabyte from a file of a few kilobytes, is high. It also checks that local file header offsets plus compressed sizes do not overlap, which detects the 2019 technique by David Fifield that reaches petabytes without nesting, and it detects quines (an archive that contains itself). For gzip, bzip2 and xz it streams the decompressor with a hard byte cap and reads the gzip ISIZE trailer. Nothing is fully extracted. Limits: a legitimately compressible file such as a sparse disk image or a log of repeated lines also has a high ratio, so the report shows the ratio and the entry names for you to judge.
Why it matters
A decompression bomb targets whatever opens it: an antivirus engine, a mail gateway, a backup indexer or the person who double-clicks. The classic 42.zip expands from 42 KB to 4.5 PB through nesting; Fifield's overlapping-entry construction reaches similar sizes in one layer, defeating scanners that only unpack the outer level. The result is disk exhaustion or a hung process, and because most scanners give up once they hit a limit, a bomb is also used to mask other content in the same archive.
How to fix it
Do not extract it. To inspect, list declared sizes without extracting (unzip -l or 7z l) and compare with the file size. If you must extract, do it in a virtual machine with a small disk. Developers processing uploads should enforce limits before extraction rather than after:
import zipfile
MAX_TOTAL, MAX_RATIO = 200 * 1024 * 1024, 100
with zipfile.ZipFile(path) as z:
total = sum(i.file_size for i in z.infolist())
if total > MAX_TOTAL or total > MAX_RATIO * os.path.getsize(path):
raise ValueError("refusing suspicious archive")ClamAV exposes MaxFileSize, MaxScanSize and MaxRecursion for the same purpose. Guide: archives and zip bombs. Related: nested archives.
Where this fits
Decompression bomb is check 4 of 20 that the file malware scanner runs under file structure and malware indicators, ordered the way they are worth fixing. That ordering is the point: Fixing this one while the check above it still fails buys less than it looks like.
Fix this one first
Above it in the same category sits Archive contains an executable (high), where the archive holds an executable, installer, script or shortcut, the standard way to get a program past an email filter that blocks bare attachments. An attacker who has that does not need this, so it is the better use of the same hour.
What fixing this still leaves open
Decompression bomb closes one route in. Immediately below it: Double file extension, where the filename has a document-looking extension in front of a final executable one, such as invoice.pdf.exe, a disguise that depends on Windows hiding known extensions; Executable embedded inside another file, where an executable program is embedded inside a file of another type, such as a Windows binary hidden in a PDF, an Office document, an RTF or an image; File content does not match its extension, where the bytes inside the file identify a different format from the one its extension claims, such as a Windows program named as a PDF or a zip named as an image.
The first few lines
You are a senior web engineer. I ran a security and SEO scanner against my site and it reported the finding below. Fix it properly rather than suppressing the symptom.
Finding: Decompression bomb (high severity)
Scanner check id: archive-bombThe rest of this prompt names the pages and line numbers we found the problem on, the configuration to change, and the constraints a good answer has to respect. It is free, it just needs an account so the work is not scraped wholesale.
Sign in with GoogleSigning in is free and takes one click. We store your email address and nothing else.
