Security Hardening: Prevent Zip Slip (Arbitrary File Write) in ExtractUtil

[Samer666569]

This PR patches a potential Zip Slip vulnerability in ExtractUtil.java by validating that the destination path of extracted archive entries resolves strictly within the intended target directory.

Previously, malicious archives containing directory traversal sequences (EX: ../../evil.txt) could potentially write files outside the working directory during extraction.

Changes:

ExtractUtil.java: Added normalize() and startsWith() checks to sanitise entry paths before writing. Throws IOException if a traversal attempt is detected.

ExtractUtilTest.java: Added a regression test (testExtractArchive_zipSlipVulnerability) to verify that path traversal attempts are correctly blocked.

Context & Background:

This issue was originally reported to the Google VRP (Report #474540831). While the security team determined that malicious build rules fall outside the immediate threat model, they acknowledged that the victim relies on the tool to handle upstream archives safely.

I am submitting this fix as a Defense in Depth measure. It protects developers from compromised upstream repositories or "Honeypot" archives, ensuring that even if a user configures Copybara to fetch from an untrusted source, the tool does not facilitate arbitrary file writes on the host machine.

Existing tests passed.

New test case confirms the fix blocks the exploit.

For better context, I am attaching the PoC video that was originally submitted with VRP Report #474540831.

Video demonstrates the Zip Slip vulnerability in action: simply running Copybara against a malicious archive results in a file being written outside the destination directory (Arbitrary File Write), confirming the need for the path validation logic added in this PR.

2026-01-09.19-13-45.mp4

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.