Fix #21003: Validate extraction paths to prevent Zip Slip path traversal

[R-Panic]

Fixes #21003

Summary

Fixed a security vulnerability in downloadProgramArtifacts where files from tar.gz archives could be extracted without proper path validation, making the system vulnerable to Zip Slip (Path Traversal) attacks.

Changes

1. Added path validation using filepath.Clean()

   • Validates that all extracted files remain within the target directory
   • Prevents path traversal via malicious archive filenames (e.g., ../../etc/passwd)

2. Added filename validation

   • Rejects empty filenames, . (current directory), and .. (parent directory)
   • Returns clear error message for invalid filenames

3. Implemented safe extraction

   • Strips directory components using filepath.Base()
   • Flattens nested paths to ensure files are extracted directly to target directory
   • Additional safety check verifies resolved path is within target directory

4. Comprehensive test coverage

   • Added TestDownloadProgramArtifacts_PathTraversal_ZipSlip with multiple attack vectors
   • Added TestDownloadProgramArtifacts_ValidExtraction to verify proper flattening
   • All existing tests continue to pass

Security Impact

This fix prevents potential Remote Code Execution (RCE) or system compromise by blocking malicious archives attempting to overwrite critical system files.

[Moses-main]

Hi team,

I'll validate extraction paths to prevent Zip Slip path traversal vulnerabilities. This is a critical security fix.

My approach:

1. Review current extraction logic
2. Add path validation
3. Test with malicious paths
4. Ensure no bypasses

Please assign!