fix: enhance ZIP entry name validation to reject Windows-style absolute paths

Updated the _isSafeZipEntryName function to explicitly reject Windows-style absolute paths and drive-letter prefixes, ensuring consistent security across all platforms. Added corresponding test cases to validate these changes.

Author: dougrathbone

src/cbusProjectParser.js

@@ -16,7 +16,12 @@ const MAX_DECOMPRESSED_BYTES = 100 * 1024 * 1024; // 100MB
 // names on write, so we can't reach this path from a JS-built archive.
 function _isSafeZipEntryName(name) {
     if (typeof name !== 'string' || name.length === 0) return false;
-    if (path.isAbsolute(name)) return false;
+    // ZIP entry names use forward slashes regardless of platform, and a
+    // malicious archive can embed any separator or drive letter. `path.isAbsolute`
+    // is host-OS specific (e.g. on POSIX it misses `C:\...` and `\\server\...`),
+    // so test both conventions and reject any drive-letter prefix explicitly.
+    if (path.posix.isAbsolute(name) || path.win32.isAbsolute(name)) return false;
+    if (/^[A-Za-z]:/.test(name)) return false;
     const parts = name.split(/[/\\]/);
     return !parts.includes('..');
 }

tests/cbusProjectParser.test.js

@@ -265,6 +265,14 @@ describe('CbusProjectParser', () => {
             expect(_isSafeZipEntryName('foo/../../etc/passwd')).toBe(false);
             expect(_isSafeZipEntryName('/etc/passwd')).toBe(false);
             expect(_isSafeZipEntryName('foo\\..\\..\\bar')).toBe(false);
+            // Windows-style absolute paths must be rejected on every host OS,
+            // not just Windows: path.isAbsolute() is platform-specific and a
+            // POSIX host would otherwise let these through.
+            expect(_isSafeZipEntryName('C:\\Windows\\system32')).toBe(false);
+            expect(_isSafeZipEntryName('C:/Windows/system32')).toBe(false);
+            expect(_isSafeZipEntryName('\\\\server\\share\\file')).toBe(false);
+            expect(_isSafeZipEntryName('\\foo')).toBe(false);
+            expect(_isSafeZipEntryName('D:relative')).toBe(false);
             expect(_isSafeZipEntryName('')).toBe(false);
             expect(_isSafeZipEntryName(undefined)).toBe(false);
         });