ZIP nested 10 levels deep

Handle it in code

Each snippet below was run against this exact file with Python 3.14.4 and Node 24.15.0 when this page was built, and the output shown is what it printed.

Python

Recursive extraction needs a depth limit as well as a size limit, or one small file becomes an unbounded amount of work.

import io, zipfile

MAX_DEPTH = 3

def walk(data, depth=0):
    with zipfile.ZipFile(io.BytesIO(data)) as z:
        for info in z.infolist():
            if info.filename.lower().endswith(".zip"):
                if depth + 1 > MAX_DEPTH:
                    raise ValueError(f"refused: archives nested deeper than {MAX_DEPTH} ({info.filename})")
                walk(z.read(info), depth + 1)

try:
    with open("nested-10-deep.zip", "rb") as f:
        walk(f.read())
    print("ok")
except ValueError as e:
    print(e)

Run against this file, it prints: refused: archives nested deeper than 3 (level-4.zip)