Skip to content

Vulnerability: CWE-409 (zip-bomb) #589

Description

@d3r3kk

Describe the bug
Mitigate vulnerability CWE-409, commonly known as 'zip-bomb'.
See CWE-409 for a longer description and more context.

Since we implement compressed file handling in gctoolkit, and handle .zip and .tar.gz files, we are susceptible to this particular vulnerability (and thus, all consuming applications are too). Note that standard Java libraries do not handle this vulnerability today.

We have provided a change that mitigates the vulnerability, but John (@johnoliver) and I both agree it's too complicated (and very likely too brittle) to incorporate into this library. We would like feedback to decide what to do, and we will make our choice in late Sept/early Oct 2026.

Alternatives we are considering:

  • Remove IO handling from gctoolkit (shifts IO responsibility)
    • Enforce wrapping application handling for IO
    • gctoolkit accepts stream data only
  • Reduce handling to just .zip - Apache compression lib mitigates (reduced functionality)
  • Shell out to the system OS - responsibility on the deployment dependencies.
  • Do not mitigate at all, provide guidance for consuming services/applications.

Activity

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Labels

No labels
No labels

Type

No type

Projects

No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions