Fix: sanitize archive extraction paths in RPA.Archive (zip slip)

[mikahanninen]

Summary

Fix the zip-slip / path-traversal vulnerability reported in #1339.

Archive.extract_archive() in packages/main/src/RPA/Archive.py calls zipfile.ZipFile.extractall() and tarfile.TarFile.extractall() on archive members without validating that resolved member paths stay within the target extraction directory. A crafted archive entry (e.g. ../../evil.py) can write files outside the intended path.

Location

packages/main/src/RPA/Archive.py, extract_archive() (currently lines ~374-386).

Fix approach

• Before extracting, resolve each member's destination path against the target directory and reject/skip entries that would escape it (classic Zip Slip guard), for both the zipfile and tarfile branches.
• For tarfile, additionally pass filter="data" (Python 3.12+ safe extraction filter) where available.
• Add a regression test using a crafted archive with a ../ path traversal entry, asserting extraction is rejected/contained.

Related

Sub-issue of #1339.

[mikahanninen]

Closed with PR #1341

[mikahanninen]

This was fixed in `db53f04e3` (#1341), merged 2026-07-18 — `Extract Archive` now validates that every archive member resolves within the destination directory before extracting, for both the `zipfile` and `tarfile` code paths, raising `ValueError` otherwise. A regression test with a crafted `../` path-traversal entry was added in `test_archive.py`.

Closing as fixed.