ZIP Bombs and Path Traversal: Where Is a Data Collector’s Trust Boundary?
A design that keeps processing resources predictable by limiting the permitted size, entries, and paths of compressed inputs. Even a small upload can require substantial memory after decompression. Using filenames directly as paths can also risk affecting files outside the analysis system.