On #curl's --max-filesize and --compressed. Should we do something about the "compression bomb" risk?
On #curl's --max-filesize and --compressed. Should we do something about the "compression bomb" risk?
@bagder I do like “the --max-filesize limit be applied on the uncompressed size as
well” but I don't know how you would implement it. How will you know in advance what the uncompressed size is going to be?
Therefore, I believe the current behavior is sufficient and portable. More importantly, it is not a surprise.