@znep that's a pretty crazy attack.   

Maybe we don't have to unzip every file, or even unzip the files at all.  Check out this project:
https://truezip.java.net/