Harden archive extraction
fix(security): harden archive extraction (#16203)
Harden archive extraction3aa94a-fix-harden-archive-extraction-cve-2026-28453fixharden archive extraction security
Committed by steipete
commit message
fix(security): harden archive extraction (#16203)
* fix(browser): confine upload paths for file chooser
* fix(browser): sanitize suggested download filenames
* chore(lint): avoid control regex in download sanitizer
* test(browser): cover absolute escape paths
* docs(browser): update upload example path
* refactor(browser): centralize upload path confinement
* fix(infra): harden tmp dir selection
* fix(security): harden archive extraction
* fix(infra): harden tar extraction filterEditor assessment
This commit patches CVE-2026-28453. The header `fix(security): harden archive extraction (#16203)` names the risky operation and the type is right, but `harden` remains unspecific about whether the fix blocks traversal, symlink escapes, or oversized entries. The body is a nine-item list of squashed commit titles covering upload path confinement, download filename sanitization, lint cleanup, tests, docs, and tar filtering; it enumerates what moved but never explains why the extraction path was unsafe. That list is closer to a PR changelog than to motivation, and the unrelated lint and docs bullets dilute it further. Technically the message is clean, yet the reader still has to reconstruct the threat model.