jeecgboot/JeecgBoot · error · IOException

单个文件解压超限，可能是zip bomb攻击

Error message

单个文件解压超限，可能是zip bomb攻击

What it means

Thrown by AiragKnowledgeDocServiceImpl.copyLimited() when a single extracted file exceeds MAX_FILE_SIZE (150 MB / 157286400 bytes). The method copies the zip entry's input stream in 8192-byte chunks and checks the running total after each read, aborting immediately when the limit is exceeded.

Solutions

1. Remove or compress files larger than 150 MB from the archive before uploading.
2. If large files are expected, increase MAX_FILE_SIZE (currently 150 MB) after verifying sufficient disk space.
3. Split very large files or store them outside the zip and reference them separately.

try {
    unzipFile(zipFilePath, targetDir, callback);
} catch (IOException e) {
    if (e.getMessage().contains("单个文件解压超限")) {
        log.warn("Single file size limit exceeded during extraction: {}", e.getMessage());
        throw new JeecgBootException("压缩包内单个文件超过150MB限制，请精简后重试");
    }
    throw e;
}

When it happens

Trigger: Extracting a zip archive containing a single file larger than 150 MB uncompressed. The check is per-file, not cumulative — each file is independently limited. The copy aborts mid-stream, so the partially written file may remain on disk.

Common situations: An archive containing large media files (videos, high-res images, large datasets); a zip-bomb with a single enormous decompressed entry; legitimate large binary files that exceed the 150 MB per-file limit.

Related errors

• 解压文件数量超限，可能是zip bomb攻击
• 解压总大小超限，可能是zip bomb攻击
• ZIP 路径穿越攻击被阻止
• 文件名包含非法字符，无法处理该文件
• 文件路径包含非法字符

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/d76d32cf111f7050. Report an issue: GitHub.

Appendix: source

Thrown at jeecg-boot/jeecg-boot-module/jeecg-boot-module-airag/src/main/java/org/jeecg/modules/airag/llm/service/impl/AiragKnowledgeDocServiceImpl.java:507

    /**
     * 复制输入流到输出流，并限制最大字节数
     *
     * @param in
     * @param out
     * @param maxBytes
     * @return
     * @throws IOException
     * @author chenrui
     * @date 2025/4/28 17:03
     */
    private static long copyLimited(InputStream in, OutputStream out, long maxBytes) throws IOException {
        byte[] buffer = new byte[8192];
        long totalCopied = 0;
        int bytesRead;
        while ((bytesRead = in.read(buffer)) != -1) {
            totalCopied += bytesRead;
            if (totalCopied > maxBytes) {
                throw new IOException("单个文件解压超限，可能是zip bomb攻击");
            }
            out.write(buffer, 0, bytesRead);
        }
        return totalCopied;
    }

}

View on GitHub (pinned to 96fb33f5ec)