ZIP Archive Format
ZIP is everywhere — downloads, backups, Java JARs, Office Open XML. Central-directory-at-end structure, path traversal (`../../`), and zip bombs are critical security concerns.
What It Defines
Container archive format: local file headers + compressed data per entry, with a central directory and end-of-central-directory record (often requiring reads from the file tail). Magic: `PK\x03\x04`. Also the container for `.docx`, `.xlsx`, `.jar`, and many other formats. MIME type: `application/zip`.
Canonical (Normative)
Convenient (Practical)
Related References
Joint ISO/IEC technical committee (JTC 1) publishes many of the binary file formats the web depends on: JPEG, PDF, MP4/ISOBMFF, ZIP (ISO/IEC 21320), and office document containers. Specs are often available via national body mirrors; some are freely readable online.
Related Specs
Every upload, download, attachment, and asset pipeline crosses these layers. Misunderstanding header vs envelope causes MIME spoofing bugs, parser differentials, and broken file validation. Start here before diving into individual format specs.
`.gz` files, HTTP Content-Encoding: gzip, and tarball distribution (`.tar.gz`) all depend on this format. Know header vs raw DEFLATE stream.
Docker layers, npm pack, Linux package sources, and backup workflows use tar. ustar and PAX extensions define long filenames and metadata.
PDF is the standard for invoices, reports, contracts, and printable documents. Object/stream structure, encryption, and embedded content matter for parsing, redaction, and security review.