bug: prevent Zip Slip path traversal in /import zip extraction

[devin-ai-integration]

Summary

Fixes a Zip Slip (CWE-22) in POST /import: routes/index.js passed an attacker-uploaded archive straight to zip.extractAllTo(extracted_path, true), so an entry named ../../usr/src/goof/public/about.html (see exploits/zip-slip/malicious_backup.zip) is written outside /tmp/extracted_files — arbitrary file overwrite as the app user.

Extraction now goes through two new helpers in utils.js instead of extractAllTo:

safe_extract_path(root, entryName) // path.resolve(root, name) must equal root or start with root + path.sep, else null
safe_extract_zip(zip, dest)        // per-entry: skip (log) unsafe names, mkdir -p + writeFileSync the rest

Backslashes are normalized before resolving, and absolute/empty entry names are rejected, so ..\..\x, /etc/passwd and a/../../x are all skipped rather than written.

Also bumps adm-zip 0.4.7 → 0.4.16 (0.4.7 has no traversal protection of its own); the enforcement above does not depend on the bump.

tests/zip-slip.spec.js covers the path helper's rejection cases and extracts the real malicious archive, asserting the traversal entry never lands outside the destination while backup.txt still extracts.

Devin-Org: engineering

---

Written by Devin