How to use Archive::Extract safely - againist zip bomb or similar?

Question

Problem outline:

• need allow upload ZIP files (and tgz and more compressed directory trees) via web-from
• the zip files should be extracted for their content handling
• planning to use Archive::Extract for the extracting
• here are things like ZIP BOMBS and like...

From the manual

Archive::Extract can use either pure perl modules or command line programs under the hood. Some of the pure perl modules (like Archive::Tar and Compress::unLZMA) take the entire contents of the archive into memory, which may not be feasible on your system. Consider setting the global variable $Archive::Extract::PREFER_BIN to 1 , which will prefer the use of command line programs and won't consume so much memory.

The questions are:

• When I set the $Archive::Extract::PREFER_BIN = 1 - i'm enough protected againist ZIP-BOMB like things?

• $Archive::Extract::PREFER_BIN protect me againist much memory usage - but, the standard unzip, tar -z unrar binaries are safe againist zip bomb like attacks?

• If not - how to handle safely uploaded compressed directory tree? (so here is not only one file inside the e.g zip archive).

Answer 1

$Archive::Extract::PREFER_BIN = 1 doesn't protect you against zip bombs, you are passing the problem to the binary unzip tool of your system.

This SO question may helps you. I like the idea of running a second process with ulimit.