Analyzing the Cause of a Zip Bomb Error During Excel Upload and Resolving It by Relaxing Apache POI Settings

Zip Bomb Error Occurrence and Cause Analysis

A Zip Bomb error occurred in a client company's Excel file upload delivery request feature. A Zip Bomb is an attack technique in which a compressed file is small in size but generates massive amounts of data when decompressed, consuming server resources. The Apache POI library performs ZIP decompression and XML parsing of Excel files (.xlsx), and when it detects an abnormal compression ratio, it throws a 'Zip bomb detected' error.

Analysis of the error log revealed that the compression ratio of the xl/styles.xml file was measured at 0.009987, lower than the system setting value of MIN_INFLATE_RATIO 0.010000, causing it to be blocked. This was because identical dxf tags within styles.xml (font color FF9C0006, background color FFFFC7CE, etc.) were excessively repeated, maximizing the compression ratio. Since compression algorithms replace repeating patterns with shorter codes, the more repeated data there is, the higher the compression ratio becomes.

Resolution and Future Plans

Given the nature of the service, where only contracted users have access, the likelihood of malicious attacks was judged to be low. As a first measure, the ZipSecureFile.setMinInflateRatio(0.01) method was used to adjust the minimum inflate ratio and relax the check. Going forward, more fundamental security measures such as file size limits and compressed file hierarchy limits will be established to strengthen system stability and security.