Problem

Currently, unzip_folder() in ebcli/core/fileoperations.py extracts zip entries without validating that resolved file paths remain within the target directory. A zip entry named ../../../.bashrc, for example, resolves outside the extraction directory and writes to an arbitrary location on the user's filesystem.

A second vulnerable path exists in createops.py, where download_and_extract_sample_app() calls ZipFile.extractall() with no filtering during eb create.

Fix

Before writing each file, resolve the target path with os.path.realpath() and verify it starts with the extraction directory. If a zip entry would escape, raise ValidationError and refuse to write. Replace the bare extractall() in createops.py with a call to the now-safe unzip_folder(), consolidating all extraction through the validated path.

Testing

• Unit tests (4 new): normal extraction works, ../ traversal blocked, absolute paths blocked, deep/redundant legitimate paths work
• Broader suite: 1763 passed, 34 skipped
• Manual E2E: crafted a malicious zip with ../../../../../../../tmp/eb-triage-pwned.txtentry --> unpatched code writes to /tmp/eb-triage-pwned.txt, patched code raises ValidationError and no file is written