On: Defending a website with Zip bombs

[cyounkins]

It's unlikely any of the parsers would apply recursive decompression, so a ZipQuine isn't going to help exhaust resources.

[vog → cyounkins]

Indeed. ZipQuines are not targeted against servers, but against middleware. More precisely, these try to attack certain kinds of "security scanners". Those security scanners want to unpack as much as possible, by design(!), otherwise bad code could hide behind yet another round of compressed container formats.

[masklinn → vog]

Yes scanners and AV is what's targetted by quines.

[pinpeliponni → cyounkins]

At least none of the Java libraries seemed to fall for this when I tried.

[amenghra → cyounkins]

True. I wonder what's the largest file you can decompress to given some bound on the compressed result.