I'm building an ASP.NET application deployed to IIS and I am actively working on following the necessary steps to enable support for
There are no current plans for the server I'm working to be deployed to the public web, but I would like to at least investigate options for mitigation of ZipBomb attacks on my server. If my client makes the decision to make their application available to its users through public channels, I would like to already have my ducks in a row.
If I were to be able to figure out how to get GZ POST bodies to come through IIS (active item on SO related to that) what would be my options for detecting the size of the uncompressed content without unpacking the file?
As an illustration- if someone POSTed 42 to my server, decompressing the contents would detonate the bomb. Do any options exist to detect that "this" 42kb represents 4.5PB of data and reject it?
How does one programatically detect that zipped content is layered without detonating the bomb and without streaming the content into a fixed size buffer?
(That is to say: is there any utility, service, or methodology that can be applied generally to interrogate the contents of a zip file without actually opening it up?)