Mastodawn

daniel:// stenberg://Mar 2

On #curl's --max-filesize and --compressed. Should we do something about the "compression bomb" risk?

https://curl.se/mail/archive-2026-03/0000.html

curl: --max-filesize and --compressed

Mike Fiedler, Code Gardener

@bagder we apply a compression ratio check prior to decompression for this case
https://github.com/pypi/warehouse/blob/481300222f98d96ce587311fd5a791daeccff791/warehouse/forklift/legacy.py#L82
https://github.com/pypi/warehouse/blob/481300222f98d96ce587311fd5a791daeccff791/warehouse/forklift/legacy.py#L296

warehouse/warehouse/forklift/legacy.py at 481300222f98d96ce587311fd5a791daeccff791 · pypi/warehouse

The Python Package Index. Contribute to pypi/warehouse development by creating an account on GitHub.

GitHub