KMZ is a ZIP container, so safe handling starts before geometry parsing. Archive paths, compression ratios, entry counts, and the selected KML document all need deterministic limits.
A practical preparation workflow
- 1
Inspect archive structure and reject unsafe paths.
- 2
Select the bounded KML document.
- 3
Normalize supported geometry and retain archive evidence.
What to check
- Archive path traversal
- Compression and entry budgets
- Primary KML selection
- Embedded and remote resource limits
Keep this limitation visible
The public browser tool accepts plain KML; KMZ processing belongs in the authenticated file pipeline.