[Security] How handle symbolic link in the archive

[miurahr]

Security professionals who reported in past development suggests py7zr should make a feature of expansion of symbolic as OPTIONAL. The feature easily become security concern. For example, allowing symbolic link to system password database to expose secret, or send an infinite loop of link to attack system.

Instead of the security concern, user requests to provide an option to skip a sanitary check.
#636

These two opinion goes opposite direction.

The project has experienced the security fix several times, and I want to make the security higher priority.

Now I am working on make the symlink feature as optional and force user to put an EXPLICIT option for extrtact method.
#482

The change will make surprise for users because of changing the behavior.

I think a sanity check logic of the library is not perfect, so there is always risk to get attacks.

[miurahr]

Attacker can use a malformed 7z file with loop-of-symlinks. Extractor may enter the infinite loop and consume file system resources that means helping DoS attack. py7zr don't have a good protection from it.