Mastodawn

On #curl's --max-filesize and --compressed. Should we do something about the "compression bomb" risk?

https://curl.se/mail/archive-2026-03/0000.html

curl: --max-filesize and --compressed

@bagder i mean, the entire goal of --max-filesize is setting the maximum limit of the file, regardless of how small the compressed bytes are. Just like the name implies

Show thread

Yonle

@bagder if --max-filesize is relying on ContentLength, then making separate flag like --max-output-size is better.

if there's --max-filesize + --compressed paired together, warn user to use --max-output-size instead