Warn against using scrapy.downloadermiddlewares.decompression

docs/news.rst

@@ -17,6 +17,12 @@ Scrapy 1.8.4 (unreleased)
     to the decompressed response body. Please, see the `7j7m-v7m3-jqm7 security
     advisory`_ for more information.
 
+    .. _7j7m-v7m3-jqm7 security advisory: https://github.com/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7
+
+-   Also in relation with the `7j7m-v7m3-jqm7 security advisory`_, use of the
+    ``scrapy.downloadermiddlewares.decompression`` module is discouraged and
+    will trigger a warning.
+
 
 .. _release-1.8.3:
 

scrapy/downloadermiddlewares/decompression.py

@@ -8,6 +8,7 @@ import zipfile
 import tarfile
 import logging
 from tempfile import mktemp
+from warnings import warn
 
 import six
 
@@ -16,8 +17,18 @@ try:
 except ImportError:
     from io import BytesIO
 
+from scrapy.exceptions import ScrapyDeprecationWarning
 from scrapy.responsetypes import responsetypes
 
+warn(
+    "Use of the scrapy.downloadermiddlewares.decompression module is "
+    "discouraged, as it is susceptible to decompression bomb attacks. For "
+    "details, see "
+    "https://github.com/scrapy/scrapy/security/advisories/GHSA-7j7m-v7m3-jqm7",
+    ScrapyDeprecationWarning,
+    stacklevel=2,
+)
+
 logger = logging.getLogger(__name__)