fix: arbitrary file access during archive extraction (zip slip)

[odaysec]

Ticket 🎟️ #13765

To fix the problem, we need to ensure that the output paths constructed from tar archive entries are validated to prevent writing files to unexpected locations. This can be done by verifying that the normalized full path of the output file starts with a prefix that matches the destination directory. We will use java.nio.file.Path.normalize() and java.nio.file.Path.startsWith() for this purpose.

Pre-merge author checklist

• I’ve followed MetaMask Contributor Docs and MetaMask Mobile Coding Standards.
• I've completed the PR template to the best of my ability
• I’ve included tests if applicable
• I’ve documented my code using JSDoc format if applicable
• I’ve applied the right labels on the PR (see labeling guidelines). Not required for external contributors.

Pre-merge reviewer checklist

• I've manually tested the PR (e.g. pull and build branch, run the app, test code being changed).
• I confirm that this PR addresses all acceptance criteria described in the ticket it closes and includes the necessary testing evidence such as recordings and or screenshots.

[github-actions]

CLA Signature Action:

Thank you for your submission, we really appreciate it. We ask that you all read and sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just by adding a comment to this pull request with this exact sentence:

I have read the CLA Document and I hereby sign the CLA

By commenting with the above message you are agreeing to the terms of the CLA. Your account will be recorded as agreeing to our CLA so you don't need to sign it again for future contributions to this repository.

1 out of 2 committers have signed the CLA.
✅ @sethkfman
❌ @odaysec

[odaysec]

/cla missing endpoint of CLA Sign on Contributor License Agreement can't open (blank-page)

[smilingkylan]

LGTM

[smilingkylan]

@odaysec Could you try agreeing to the CLA once more. Let me know if it still isn't working.

[odaysec]

Hi @smilingkylan I still can't sign the button of CLA is missing https://metamask.io/cla Contributor License Agreement

Browser:

• Mozilla Firefox
• Chrome

[sethkfman]

Added the skip-sonar-cloud for an external contributor and that code is not analyzed.

[sethkfman]

CLA Signature Action:

Thank you for your submission, we really appreciate it. We ask that you all read and sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just by adding a comment to this pull request with this exact sentence:

I have read the CLA Document and I hereby sign the CLA

By commenting with the above message you are agreeing to the terms of the CLA. Your account will be recorded as agreeing to our CLA so you don't need to sign it again for future contributions to this repository.

1 out of 2 committers have signed the CLA. ✅ @sethkfman ❌ @odaysec

@odaysec Please follow the instructions and post the specific comment in the reply above. Thanks

[odaysec]

Hi @sethkfman

Thank you for your respond, the page for signed CLA was broken i created gif for the sample of POC