[JustinGrote]

Address an issue where data paths were not properly escaped during extraction, leading to potential security vulnerabilities. This update ensures that all data paths are correctly handled to prevent any unintended exposure.

Fixes #115

[Copilot]

🟡 Changes recommended

The replacement extractor introduces permission, Windows directory-handling, and cancellation regressions.

3 open issues

• Check cancellation before processing each directory entry · New
• Recognize platform-aware trailing directory separators · New
• Preserve executable permissions during archive extraction · New

What changed in this PR

This PR addresses #115 by decoding URL-encoded package paths during module installation and validating that decoded paths remain inside the extraction directory.

Changes:

• Replaces whole-archive extraction with a custom asynchronous extraction loop.
• Adds destination containment checks after URL decoding.
• Adds a regression test for encoded spaces in file and directory names.

File	Description
Source/​Core/​ModuleFastInstaller.cs	Decodes archive paths, validates destinations, and extracts entries asynchronously.
ModuleFast.tests.ps1	Tests extraction of URL-encoded file and directory names.

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Undeclared stream variables prevent compilation, and missing parent-directory creation breaks extraction of valid packages without explicit directory entries.

2 open issues

• Remove undeclared leftover stream statement · New
• Create parent directories before extracting files · New

3 resolved since last review

• Preserve executable permissions during archive extraction
• Recognize platform-aware trailing directory separators
• Check cancellation before processing each directory entry

_{Review effort: Balanced}

[Copilot]

🟡 Changes recommended

Windows filename sanitization remains unresolved, and the replacement path-containment protection lacks negative regression tests.

1 open issue

• Sanitize Windows-invalid characters in decoded extraction names · New

1 previously missed issue

In code that hasn't changed since last review

Add extraction tests for decoded path traversal protection

Source/​Core/​ModuleFastInstaller.cs:53

The new extraction tests cover valid decoded names and cancellation, but do not exercise this replacement for the framework's path-traversal protection. They would still pass if the containment check were removed or moved before decoding. Add negative cases for %2e%2e/outside.txt, an absolute path outside the destination, and traversal into a sibling directory whose name shares the destination prefix. On Windows, also cover encoded backslashes such as %2e%2e%5coutside.txt. Assert that extraction throws and creates no file or directory outside the destination.

2 resolved since last review

• Remove undeclared leftover stream statement
• Create parent directories before extracting files

_{Review effort: Balanced}

[JustinGrote]

@copilot revise to use Path.GetInvalidFileNameChars() in a cross platform way to replace invalid characters with _

[Copilot]

Applied Path.GetInvalidFileNameChars() sanitization after URL decoding, replacing invalid characters with _ while preserving separators. Build and extraction regression tests pass; commit 5907ea6.