kitearchive/io.github.yuroyami.kitearchive.security/ArchiveLimits

ArchiveLimits

data class ArchiveLimits(val maxUncompressedBytes: Long = 2L * 1024 * 1024 * 1024, val maxCompressionRatio: Int, val maxEntries: Int, val maxNestingDepth: Int = 8)

Decompression-bomb defences, applied during decode (never trust a declared size for allocation). Passed into every decompress/read call; the defaults are deliberately safe so a caller cannot forget them.

See the classic 42.zip (42 KB → 4.5 PB) and Fifield's non-recursive overlapping bombs (~10 MB → 281 TB in one pass). The only universal defence is a hard cap on bytes written, which checkOutputSize enforces.