https://www.securecoding.cert.org/confluence/display/java/IDS04-J.+Safely+extract+files+from+ZipInputStream

(I haven't looked at the suggested code closely in that example)

https://github.com/ptoomey3/evilarc

Hrm, yeah, I guess assuming you trust FilenameUtils.getName to securely handle stripping out path information then that is probably ok.  A quick glance at that code looks fine, at least on Unix.

As far as infinite expansion, that is just a special sequence of a small number of compressed bytes that expands to a giant number of uncompressed bytes.