fix: optimized archive extraction path traversal checks

Author: cyberchen1995

opensca/walk/path.go

@@ -0,0 +1,27 @@
+package walk
+
+import (
+	"fmt"
+	"path/filepath"
+	"strings"
+)
+
+func resolveExtractPath(output, entry string) (string, error) {
+	if filepath.IsAbs(entry) {
+		return "", fmt.Errorf("invalid file path: %s", entry)
+	}
+
+	base := filepath.Clean(output)
+	target := filepath.Join(base, entry)
+
+	rel, err := filepath.Rel(base, target)
+	if err != nil {
+		return "", err
+	}
+
+	if rel == ".." || strings.HasPrefix(rel, ".."+string(filepath.Separator)) {
+		return "", fmt.Errorf("invalid file path: %s", entry)
+	}
+
+	return target, nil
+}