Add check for decompression bomb vulnerabilities

Open kfess opened this issue 3 weeks ago • 0 comments

Is your feature request related to a problem? Please describe.

Bandit currently does not detect potential decompression bomb vulnerabilities.

Describe the solution you'd like

Add a new check (for example, B114) that detects:

Direct dangerous calls:
- gzip.decompress()
- zlib.decompress()
- bz2.decompress()
- lzma.decompress()
- and other standard libs.
Reading from compressed files without size limit:
- gzip.open() followed by .read() without size argument

Describe alternatives you've considered

gosec (Go security checker) has a similar rule (G110).

Additional context

Nov 29 '25 16:11 kfess