我应该担心受感染的 zip 文件吗？
我正在编写一个 ASP.NET 应用程序来处理用户提交的 zip 文件，并将从中提取的文件限制为仅我想要的扩展名。
我听说过电子邮件中附加了受感染的 zip 文件，我想知道是否应该担心从应用程序中的受感染 zip 文件中提取数据。我不打算执行 zip 文件内的内容，但打开并提取受感染的 zip 文件是否会导致该文件执行病毒，即使我没有执行 zip 文件内的任何内容？
I'm writing a ASP.NET application to process user submitted zip files and limiting my extraction of files from it to only the extensions I want.
I've heard of infected zip files attached to emails and I was wondering if I should be concerned about extracting data from infected zip files in my application. I don't plan on executing the content inside of the zip file, but will opening and extracting from an infected zip file cause the file to execute a virus even if I'm not executing any content inside of the zip file?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果有人在解压缩实现中发现可利用的缺陷，这是可能的……但我从未见过。我不会说这是值得担心的事情。
然而，隔离传入的文件、扫描它们并稍后将它们移至您的应用程序并不困难。您甚至可以进行按需扫描，但这可能会在繁忙的系统上造成严重的瓶颈。这完全取决于您需要扫描上传文件的速度。
It's possible if somebody finds an exploitable flaw in the unzipping implementation... But I've never seen one. I wouldn't say it's something to get worried over.
However, it's not hard to quarantine incoming files, scan them and move them off to your application at a later time. You could even do on-demand scanning but that can cause nasty bottlenecks on a busy system. It all depends how fast you need an uploaded file scanned.