Thomas Bechtold 4df9a0ce10 feat(archive): add extractor interface and zip/tar implementations ...

Introduce the internal/archive package with a generic Extractor
interface for extracting archive contents to a destination directory.

Includes two implementations:
- ZipExtractor: handles zip-based archives (.zip, .jar, .war, etc.)
- TarExtractor: handles tar-based archives (.tar, .tar.gz, .tar.bz2, etc.)

Both extractors enforce configurable safety limits and protect against
common malicious-archive vectors:
- Per-archive extraction size limit
- Per-archive file count limit
- Zip-slip path traversal prevention via existing SafeJoin
- Symlink entries are written as real symlinks only when their target
  resolves inside destDir; symlinks pointing outside are dropped to
  avoid escape via symlink-then-write
- Non-regular non-symlink entries (devices, fifos, sockets) are skipped
  because their contents can't safely round-trip to disk

Also provides FindExtractor for auto-detecting archive format, and
IsExcludedExtension for filtering by extension.

Signed-off-by: Thomas Bechtold <thomasbechtold@jpberlin.de>

2026-04-27 08:47:16 +02:00

..

extractor_test.go

feat(archive): add extractor interface and zip/tar implementations

2026-04-27 08:47:16 +02:00

extractor.go

feat(archive): add extractor interface and zip/tar implementations

2026-04-27 08:47:16 +02:00