Potential fix for code scanning alert no. 4: Arbitrary file access during archive extraction ("Zip Slip")

[cleemullins]

#minor

Potential fix for https://github.com/microsoft/botbuilder-dotnet/security/code-scanning/4

The fix is to ensure that any file path derived from the archive is not able to escape the intended extraction directory. The standard mitigation is to combine the extraction root (path) with the archive entry’s file name (as currently), then resolve this combined path to an absolute path (resolving traversals/links), and confirm it is still within the extraction root (also resolved to a canonical absolute path). If not, extraction should immediately abort with an exception. This must be done both for files and directory creation.

Specifically, in ExtractZipFolder:

• After calculating the destination path with Path.Combine(path, entryName), use Path.GetFullPath on it.
• Also get the full path of the extraction root, with a path separator at the end.
• Before extracting (either directory creation or file extraction), check that the target path starts with the extraction root’s full path.
• Throw an exception if any entry does not meet this.

This change needs to be applied to both branches: directory creation (line 167) and file extraction (line 171).

No additional dependencies are needed, but care needs to be taken to only change the vulnerable region.

---

Suggested fixes powered by Copilot Autofix. Review carefully before merging.