Croway opened a new pull request, #24817: URL: https://github.com/apache/camel/pull/24817
## Summary _Claude Code on behalf of Croway_ The `maxDecompressedSize` setting (default 1 GB) protects against decompression bombs, but was only enforced when `usingIterator=false`. When `usingIterator=true` — the common mode for multi-entry archives and streaming splits — neither `ZipIterator` nor `TarIterator` received or enforced the limit, completely defeating decompression-bomb protection in iterator/splitter mode. **Changes:** - **`ZipIterator`**: added `maxDecompressedSize` field and changed `IOHelper.copy` call in `getNextElement()` to use the 5-argument overload that enforces the limit - **`ZipFileDataFormat`**: propagates `maxDecompressedSize` to `ZipIterator` in the `usingIterator` unmarshal branch - **`TarIterator`**: added `maxDecompressedSize` field and wraps entry streams in `MaxDecompressedSizeInputStream` when the limit is active - **`TarFileDataFormat`**: propagates `maxDecompressedSize` to `TarIterator` in the `usingIterator` unmarshal branch - **`MaxDecompressedSizeInputStream`** (new): a `FilterInputStream` that counts bytes read and throws `IOException` when the decompressed size limit is exceeded — used by `TarIterator` to preserve lazy/streaming reads required by `TarArchiveInputStream` - **Tests**: added `testUnzipMaxDecompressedSizeWithIterator` and `testUntarMaxDecompressedSizeWithIterator` to confirm the limit is enforced in iterator mode ## Test plan - [x] `cd components/camel-zipfile && mvn verify` — 44 tests pass (0 failures) - [x] `cd components/camel-tarfile && mvn verify` — 43 tests pass (0 failures) - [x] New tests confirm `CamelExecutionException` is thrown when `maxDecompressedSize=10` with `usingIterator=true` - [x] Existing tests confirm no regression in non-iterator mode or default behavior 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
