[P0] Harden Upload Validation And File Serving

[barvhaim]

Roadmap Item 4: Harden Upload Validation And File Serving

Priority: P0
Area: API security
References: src/threatxtension/api/main.py, src/threatxtension/utils/extension.py

Upload handling validates extension and max size, and file serving has directory
containment tests. The next step is to validate archive content before extraction and
make file reads safer for large or binary files.

Scope:

• Validate uploaded archive magic bytes and reject mismatched content types.
• Add decompressed-size and file-count limits to prevent archive bombs.
• Add per-file read size limits for /api/scan/file/{extension_id}/{file_path}.
• Return metadata for binary files instead of attempting text reads.

Acceptance criteria:

• Malicious zip-slip, archive bomb, wrong extension, oversized archive, and oversized
  file-read tests pass.
• File viewer remains usable for normal extension source files.
• Error responses are consistent and do not leak local filesystem details.

Phase 2: Analysis Coverage And Accuracy

---

Created from docs/roadmap.md.