On #curl's --max-filesize and --compressed. Should we do something about the "compression bomb" risk?
On #curl's --max-filesize and --compressed. Should we do something about the "compression bomb" risk?
--max-filesize should probably have been called --max-transfersize, if that is what it does
--max-transfersize for the on-wire bytes
--max-filesize for the locally stored bytes
But that would be a breaking change changing the semantics of --max-filesize.
Maybe deprecate it and add --max-transfer-size and --max-file-size (note the extra "-").