SonarQube security hotspot about zip HOT 4 CLOSED

How do you understand this warning?

In my honest opinion it's not related to zip_open. It's about, how someone can compress e.g. GB of zeros what can end up with very tiny zip archive but after unziping it's full of garbage.

So, be careful how/where do you compress your data, but it's not related to this particular call.
Moreover, in your example, you're compressing data, you're passing inFiles, so it's your app responsibility to check if these files are garbage, or not.

from zip.

Yes, agree, and it is trusted data. I just wonder if I could do something from the zip_open() call, like passing a flag, to avoid the security hotspot warning.

from zip.

No, because this warning is very informative/generic.
SonarQuebe didn't analyze the zip library, just posted some info related to zip archives from DB (the same stuff you can find for some PHP library: https://rules.sonarsource.com/php/RSPEC-5042).

I would recommend to try real static analysis tools, like cpp-check, infer, clang static analysis or PVS studio.

from zip.

Thank you, Kuba, I appreciate your input.

from zip.