Property MaxPackageCompressionRatio
MaxPackageCompressionRatio
Gets or sets the maximum allowed package compression ratio
(totalUncompressedBytes / totalCompressedBytes), or null for unlimited.
On by default (DefaultMaxPackageCompressionRatio). It is the cheapest of the package guards — the sizes come from the central directory, so nothing is inflated to compute it — and it rejects the ordinary bomb before a byte is read.
On the declared sizes being attacker-controlled. They are, and it does not help the attacker: the ZIP reader bounds each entry's decompressed stream by the size its metadata declares, so under-reporting a part to make the ratio look innocent also truncates that part on read. The result is a document that fails to parse, not one that expands. Over-reporting only makes the ratio worse. This is asserted rather than assumed — see the package-limit tests, which run on both target frameworks because the two use different ZIP implementations.
MaxUncompressedPartBytes remains the guard that bounds a single part regardless, and is the one that holds when a package spreads its expansion across entries that are each individually plausible.
public double? MaxPackageCompressionRatio { get; set; }Property Value
Exceptions
- ArgumentOutOfRangeException
The value is not finite and positive.