← Back to context

Comment by JodieBenitez

10 months ago

No, it's not about sending large files over the wire, it's about saturating the RAM of the script that reads the content. If the script is naive enough, a zip bomb will do. Example on my machine, such a snippet will cause the OS to close the python process:

    >>> from requests import get
    >>> r = get("https://acme.tld/trap/")
    >>> r.text

The server doesn't do much (serving a relatively small number of bytes) while the client basically crashes.