Fix path traversal in extract_all

[krippee]

Summary

Prevent path traversal (Zip Slip) in extract_all by validating entry paths stay within the target directory.

Changes

• Add safe_extract_path helper to validate and resolve paths
• Reject entries containing ../ sequences that escape the extraction directory

Before

output_path = File.join(output_dir, entry_path)
# Malicious entry "../../../etc/passwd" could write outside output_dir

After

output_path = safe_extract_path(base_dir, entry_path)
# Raises Error if resolved path escapes base_dir

[jkorany]

Any concerns about the single entry path?

[krippee]

Great question, normally yes. In this context though, this change is not even 100% necessary. The way we use 7-Zip in the application would prevent this type of attack, as we extract to a memory buffer, and the entry path is actually used as a label. That being said, this change is primarily for the gem itself, if it were ever to be used outside our application.

When using it outside of our application, a user may want to define their own file path which could cause issues. We could also add in an optional helper argument for sanitizing the path themselves during single extract if we wanted.

[jkorany]

LGTM!