{"record":{"id":"d76d32cf111f7050","repo":"jeecgboot/JeecgBoot","slug":"zip-bomb-d76d32","errorCode":null,"errorMessage":"单个文件解压超限，可能是zip bomb攻击","messagePattern":"单个文件解压超限，可能是zip bomb攻击","errorType":"validation","errorClass":"IOException","httpStatus":null,"severity":"error","filePath":"jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/service/impl/AiragKnowledgeDocServiceImpl.java","lineNumber":507,"sourceCode":"    /**\n     * 复制输入流到输出流，并限制最大字节数\n     *\n     * @param in\n     * @param out\n     * @param maxBytes\n     * @return\n     * @throws IOException\n     * @author chenrui\n     * @date 2025/4/28 17:03\n     */\n    private static long copyLimited(InputStream in, OutputStream out, long maxBytes) throws IOException {\n        byte[] buffer = new byte[8192];\n        long totalCopied = 0;\n        int bytesRead;\n        while ((bytesRead = in.read(buffer)) != -1) {\n            totalCopied += bytesRead;\n            if (totalCopied > maxBytes) {\n                throw new IOException(\"单个文件解压超限，可能是zip bomb攻击\");\n            }\n            out.write(buffer, 0, bytesRead);\n        }\n        return totalCopied;\n    }\n\n}\n","sourceCodeStart":489,"sourceCodeEnd":515,"githubUrl":"https://github.com/jeecgboot/JeecgBoot/blob/96fb33f5ec68516da0b0147da06b2eb0419e063a/jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/service/impl/AiragKnowledgeDocServiceImpl.java#L489-L515","documentation":"Thrown by AiragKnowledgeDocServiceImpl.copyLimited() when a single extracted file exceeds MAX_FILE_SIZE (150 MB / 157286400 bytes). The method copies the zip entry's input stream in 8192-byte chunks and checks the running total after each read, aborting immediately when the limit is exceeded.","triggerScenarios":"Extracting a zip archive containing a single file larger than 150 MB uncompressed. The check is per-file, not cumulative — each file is independently limited. The copy aborts mid-stream, so the partially written file may remain on disk.","commonSituations":"An archive containing large media files (videos, high-res images, large datasets); a zip-bomb with a single enormous decompressed entry; legitimate large binary files that exceed the 150 MB per-file limit.","solutions":["Remove or compress files larger than 150 MB from the archive before uploading.","If large files are expected, increase MAX_FILE_SIZE (currently 150 MB) after verifying sufficient disk space.","Split very large files or store them outside the zip and reference them separately."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    unzipFile(zipFilePath, targetDir, callback);\n} catch (IOException e) {\n    if (e.getMessage().contains(\"单个文件解压超限\")) {\n        log.warn(\"Single file size limit exceeded during extraction: {}\", e.getMessage());\n        throw new JeecgBootException(\"压缩包内单个文件超过150MB限制，请精简后重试\");\n    }\n    throw e;\n}","preventionTips":["Remove files larger than 150 MB from the archive before uploading.","Compress large media files or store them separately outside the zip.","Inform users of the 150 MB per-file limit in upload documentation."],"tags":["security","zip-bomb","zip","dos-prevention","rag"],"backgroundTag":null,"analyzedSha":"96fb33f5ec68516da0b0147da06b2eb0419e063a","analyzedAt":"2026-08-14T00:04:16.786Z","schemaVersion":2},"datasetVersion":"2026-08-14T00:17:13.853Z"}