Fix zip slip vulnerability, other zip issues and tests

[reimic]

🚧 Work in progress 🚧

What does this PR do?

• zip_extract_to method will now throw an exception if it encounters files with a relative path Zip Slip Vulnerability #73 ( I recommend throwing an exception instead of skipping dangerous files in zips. I was swayed by the argument that letting only some files through breaks user-data integrity.)

What problem does it fix?

• there was a vulnerability in the zip_extract_to method

How to test if it works?

• this PR explicitly tests that the zip slip / zip symlink vulnerability was fixed

[brandonpayton]

Hi @reimic, thank you for this PR. As I was reading, I found it a bit difficult to review due to multiple purposes in the changes:

What problem does it fix?

• there was a vulnerability in the zip_extract_to method
• zip functions caused an error when the code was run with PHP == 7.0
• tests were slightly off and had to be updated

Would you be willing to break this into multiple single-purpose PRs so we can focus more clearly on each issue?

[reimic]

Sure, @brandonpayton - let's start here: #94

[reimic]

Annnd, @brandonpayton - then progress to here: #95

[adamziel]

This checks for a single, very specific path. Why not test for a single, simple case like ../tmp-zip-slip-test.txt? And then confirm where the file was actually created – if anywhere?

[adamziel]

Also let's test for a path starting with /

[adamziel]

Also let's test for zipped symlinks