Extract user-downloaded archives without providing ZipBombs?

Question

My question is simple: how can I (or prevent) the user from downloading an archive that, when extracted, fills all the disk space (the so-called ZipBomb)? I am using PHP.

Answer 1

Before extracting your archive, use the functions of the PHP Zip library to make sure that the contents fall within the general size limit during extraction.

For instance:

$zip = zip_open('uploaded.zip');
$file = zip_read($zip);
$totalsize = 0;

while ($file) {
    $totalsize += zip_entry_filesize($file);
    $file = zip_read($zip); // read next file
}

zip_close($zip);

if ($totalsize > SIZE_LIMIT) {
    // not allowed!
}