Description

The ZipFile extract and extractall methods in libarchive are vulnerable to a directory traversal attack, allowing files to be written anywhere on disk, regardless of the intended target path.

This vulnerability stems from line 107 in libarchive/zip.py:

return self.readpath(name, os.path.join(path, name))

Here, os.path.join combines unsanitized user input (name) with the intended extraction path, making the method susceptible to malicious input.

Our fork addresses this issue by implementing the sanitize_filename method, which incorporates logic from the pyzipper project, a well-tested and secure solution.

Additionally, we have added docstrings to enhance code readability and maintainability.