当Python遇到zip解压炸弹，防护不到位让你泪流满面！

# -*- coding: utf-8 -*-
# @微信号   : King_Uranus
# @公众号    : 清风Python
# @GitHub   : https://github.com/BreezePython
# @Date     : 2020/09/08 23:30:33
# @File     : zip_boom.py
import os
def make_boom(file_path, file_num, string_len):
    if not os.path.exists(file_path):
        os.mkdir(file_path)
    os.chdir(file_path)
    for i in range(file_num):
        with open('boom%d.txt' % i, 'w',encoding='utf-8') as f:
            f.write('Boom' * string_len)
make_boom('zip_boom', 1000, 1000 * 1000)

from flask_wtf.file import FileField, \
    FileRequired, FileAllowed
allow_type = ['zip', 'rar', '7z']
class UploadForm(FlaskForm):
    zip_file = FileField('请上传文件：',
                         validators=[FileRequired(),
                         FileAllowed(allow_type)])
    submit = SubmitField()

from flask import Flask
app = Flask(__name__)
app.config['SECRET_KEY'] = 'Breeze Python'
app.config['UPLOAD_PATH'] = os.path.join(app.root_path, 'uploads')
app.config['MAX_CONTENT_LENGTH'] = 30 * 1024 * 1024  # 30Mb

# -*- coding: utf-8 -*-
# @微信号   : King_Uranus
# @公众号    : 清风Python
# @GitHub   : https://github.com/BreezePython
# @Date     : 2020/09/08 23:30:33
# @File     : zip_boom.py
import zipfile
import os
def unzip(filename: str):
    # 限制最大文件数100
    max_file_num = 100
    # 设置解压内容最大值(一般平均最大的压缩率20，再高就很可能是异常文件了！)
    max_file_size = 1024 * 1024 * 100 * 20
    total_size = 0
    to_zip_file = zipfile.ZipFile(filename)
    dirname = filename.replace('.zip', '')
    # 校验文件总数量
    if len(to_zip_file.filelist) > max_file_num:
        raise ValueError("压缩文件的数量超过了上限")
    # 校验解压文件内容最大值
    for file in to_zip_file.filelist:
        total_size += file.file_size
        if total_size > max_file_size:
            raise IOError("压缩包内容异常")
    # 判断文件夹重复则退出
    if os.path.exists(dirname):
        print(f'{dirname} dir has already existed')
        return -1
    else:
        # 创建文件夹，并解压
        os.mkdir(dirname)
        to_zip_file.extractall(dirname)
        to_zip_file.close()
unzip('zip_boom.zip')