Sibling of #937/#938, found immediately after that fix shipped.
list_fetch.py reads MAX_FETCH_FILE_SIZE twice - once as the zip-bomb guard on a fetched list's declared total uncompressed size (_validate_zip_members()), once as the running extraction budget (process_fetched_list_zip()) - and neither read treated 0 as "no limit" the way dcc_fetch.py's own admission check does (#302).
Reproduced live right after #938 shipped:
[LIST-FETCH] Rejected list zip from SamothMetal: zip's declared total uncompressed size exceeds MAX_FETCH_FILE_SIZE (0 bytes) - refusing to extract (zip-bomb guard)
with MAX_FETCH_FILE_SIZE explicitly at 0 in the dashboard, expecting "no limit".
🤖 Filed with Claude Code
Sibling of #937/#938, found immediately after that fix shipped.
list_fetch.pyreadsMAX_FETCH_FILE_SIZEtwice - once as the zip-bomb guard on a fetched list's declared total uncompressed size (_validate_zip_members()), once as the running extraction budget (process_fetched_list_zip()) - and neither read treated 0 as "no limit" the waydcc_fetch.py's own admission check does (#302).Reproduced live right after #938 shipped:
with
MAX_FETCH_FILE_SIZEexplicitly at 0 in the dashboard, expecting "no limit".🤖 Filed with Claude Code