bug: prevent Zip Slip path traversal in archive import

[devin-ai-integration]

Summary

/import extracted uploaded zips with zip.extractAllTo('/tmp/extracted_files', true) (adm-zip 0.4.7, no entry-name validation), so an archive entry named ../../../../root/.ssh/authorized_keys or an absolute path wrote outside the extraction directory.

Replaced it with safeExtractAllTo(zip, target), which iterates zip.getEntries() and writes each entry itself after checking containment:

var destination = path.resolve(target, entryName.replace(/\\/g, '/'));
if (isAbsolute(name) || (destination !== target && !destination.startsWith(target + path.sep))) skip;

Backslashes are normalized (Windows-style separators in entry names), absolute and drive-letter names are rejected, directories are created with mkdirSync(..., {recursive:true}), and files are written with entry.getData(). Skipped entries are logged; safe entries, including nested paths, extract as before.

Verified locally with a crafted archive containing good.txt, sub/dir/f.txt, ../../../../tmp/pwned.txt and /tmp/abs_pwned.txt: both traversal entries were skipped (no files written outside /tmp/extracted_files) and the benign entries extracted.

Devin-Org: engineering

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review