Safe zip bomb test file

Handle it in code

Each snippet below was run against this exact file with Python 3.14.4 and Node 24.15.0 when this page was built, and the output shown is what it printed.

Python

Limit what extraction may produce, not the size of the upload. Headers can lie, so the loop counts the bytes actually decompressed as well as the declared sizes.

import zipfile

MAX_TOTAL = 100 * 1024 * 1024   # refuse to produce more than 100 MB
MAX_RATIO = 100                 # or any entry that expands more than 100x

with zipfile.ZipFile("modest-zip-bomb.zip") as z:
    declared = sum(i.file_size for i in z.infolist())
    if declared > MAX_TOTAL:
        raise SystemExit(f"refused: declares {declared:,} bytes of content")
    written = 0
    for info in z.infolist():
        if info.compress_size and info.file_size / info.compress_size > MAX_RATIO:
            raise SystemExit(f"refused: {info.filename} expands {info.file_size // info.compress_size}x")
        with z.open(info) as src:
            while chunk := src.read(65536):
                written += len(chunk)
                if written > MAX_TOTAL:
                    raise SystemExit("refused: output passed the limit")
    print("ok to extract")

Run against this file, it prints: refused: declares 1,048,576,000 bytes of content