What are some potential pitfalls when uploading and extracting zip directories in PHP, and how can they be avoided?

One potential pitfall when uploading and extracting zip directories in PHP is the risk of a zip bomb attack, where a small zip file expands into a large number of files, potentially causing a denial of service. To avoid this, you can limit the size of the extracted files and implement proper error handling to prevent malicious files from being uploaded. 

// Limit the size of extracted files
$zip = new ZipArchive;
$res = $zip->open('file.zip');
if ($res === TRUE) {
    $zip->extractTo('/path/to/extract/');
    $zip->close();
    
    // Check the size of extracted files
    $extractedFiles = glob('/path/to/extract/*');
    foreach ($extractedFiles as $file) {
        if (filesize($file) > 1048576) { // 1 MB limit
            unlink($file);
        }
    }
} else {
    echo 'Failed to open the zip file.';
}

Keywords

zip directories uploading extracting PHP error handling

Related Questions