bug: fix Zip Slip in POST /import archive extraction

[devin-ai-integration]

Summary

POST /import extracted uploaded archives with zip.extractAllTo('/tmp/extracted_files', true) on adm-zip 0.4.7, so an entry named ../../usr/src/goof/public/about.html was written outside the extraction dir (Zip Slip, CWE-22, arbitrary file overwrite as the app user).

The vulnerable API is no longer called. utils.safe_extract_zip(zip, dest) now writes entries itself, running each entry.entryName through utils.safe_extract_path(root, name):

target = path.resolve(root, name.replace(/\\/g, '/'))
if (target !== root && target.indexOf(root + path.sep) !== 0) return null // skipped + logged

which rejects ../ segments, absolute names and backslash/drive-relative names. adm-zip is also bumped 0.4.7 -> 0.4.16 (defense in depth; the sink fix stands on its own). Regression test in tests/zip-slip.spec.js (uses the committed exploits/zip-slip/malicious_backup.zip), 10/10 with NODE_OPTIONS=--openssl-legacy-provider ./node_modules/.bin/tap tests/zip-slip.spec.js --no-coverage.

Devin-Org: engineering

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review