I'm working on a project for a client where they would like their users to upload a ZIP file that can be extracted. Once extracted, we would utilise certain files in there, such as images and HTML files.
It's clear that this is a huge security risk as you cannot safely check the contents of the file. The project is currently for internal users only, but they would like to open it up to external users at a later point.
The project is currently being built with Laravel, and there are no libraries that could possibly help there. So I figure this is probably going to be more of a question regarding the server itself. But what measures could we take to prevent viruses and attacks in these zips?