Direct answer
Archive processing must constrain where extracted files go and how much work extraction can consume. Test safe miniature fixtures in a sandbox and coordinate resource limits with the owner.
Map the processing workflow
Document who may upload archives, where extraction runs, permitted file types and expected limits for size, entry count and expanded content. Use an isolated test environment with synthetic files and a clear cleanup plan.
Reference: OWASP File Upload Cheat Sheet.
Test a normal archive
Upload a small valid archive and verify its expected files are processed within the designated directory. Record the accepted size and resulting files without including sensitive data. This positive control establishes the intended workflow.
- Use only tiny harmless test archives.
- Do not run archive bombs or fill disks.
- Agree a stop contact and resource budget.
Review path and limit handling
With explicit approval, use a small fixture containing a harmless entry whose path attempts to leave the designated extraction folder. Verify it is rejected or safely contained. Check documented entry and expanded-size thresholds without creating excessive resource consumption.
Retest isolation and cleanup
After changes, repeat the normal and unsafe-path fixtures and confirm no file is written outside the sandbox. Verify failed processing cleans up temporary files and legitimate users receive a clear error without internal path details.
Assessment limits
Miniature fixtures cannot establish resilience to every compression format or resource-exhaustion attack. High-load testing requires a separate performance plan and explicit authorization.
Frequently asked questions
Is a valid ZIP extension enough to make extraction safe?
No. Entries, paths, expanded size and processing behavior need validation and limits.
Should a tester upload a decompression bomb?
No. Use small bounded fixtures and agreed limits; disruptive stress tests need separate planning.
Primary sources and further reading
These guides combine published security guidance with practical assessment planning. Adapt checks to the owner's policy, environment, and authorized scope.
This guide was prepared with AI assistance using the linked sources and illustrative examples. Check current vendor guidance and your environment before making changes.