Hmmm... I think we are ok for directory traversal, since the directory structure is flattened before expanding the file. (I just realised this code doesn't account for two files with the same name in different directories being flattened, I'll go deal with that now.) Can you expand on what you mean by a infinite expansion attack in a zip file?