From 389a2d8603906507c7cd2c22cfdef174bc85ebe3 Mon Sep 17 00:00:00 2001
From: DeryFerd <deryferdikao125@gmail.com>
Date: Thu, 4 Jun 2026 21:01:40 +0700
Subject: [PATCH] fix(files): cap per-entry decompressed size during zip
 extraction

---
 backend/files/file-archive.ts | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/backend/files/file-archive.ts b/backend/files/file-archive.ts
index 3cc912ed..8f5ba259 100644
--- a/backend/files/file-archive.ts
+++ b/backend/files/file-archive.ts
@@ -228,8 +228,12 @@ async function extractWithinLimit(
 				failure = new Error(`Extracted content exceeds maximum allowed size of ${limitMB}MB`);
 				return;
 			}
-			chunks.push(chunk);
 			fileBytes += chunk.length;
+			if (fileBytes > limit) {
+				failure = new Error(`Entry "${file.name}" exceeds maximum allowed size of ${limitMB}MB`);
+				return;
+			}
+			chunks.push(chunk);
 			if (final) {
 				writes.push(writeEntry(fullPath, concatChunks(chunks, fileBytes)));
 				entryCount++;