Hacker News new | past | comments | ask | show | jobs | submit login

What we can do today:

Use different, better structured formats. (Except just about everything can handle a 'well formed' zip file)

Take care to emit well-formed zip files.

Never trust un-sanitized input. This includes ensuring that any malformed input does not escalate to a security issue such as a buffer overflow, or a path escape when not allowed.

Be tolerant of poorly formed zip files.

Have repair tools which operate in useful ways, such as 'streaming' (front to back), with optional rename / replace / etc on name collision / delete, or utilize the Nth located (backwards of forwards?) directory record set.




> Except just about everything can handle a 'well formed' zip file

This depends on the extensions that are used. For example, ZIP file can use a LZMA compression, and not all decompressors can handle it.


If LZMA is your intended target, I more strongly suggest selecting a more modern container such as the 7z archive format.

Someone selects a zip file not for it's compression, but for how widely accessible it is. Most likely this involves basic compression on text files, error detection checksums, and storage (no compression) of already well compressed images and possibly videos.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: