Module archive 

Defensive archive reading.

Nothing inside an archive is trusted before it is validated. Entry names are checked against path traversal, encrypted and special entries are refused outright, colliding names are refused, and every link is judged by the same rule the builder applied — against the archive as received rather than as intended. A box assembled by hand gets no benefit of the doubt here.

The whole archive is validated before a single byte is written. That ordering is the point: a reader that validated entry by entry while extracting would already have written the files preceding the one that turned out to be hostile.

Structs

ArchiveEntry

One validated archive entry.

Functions

extract_zip_archive

Extracts a prevalidated archive.

list_zip_entries

Lists and validates every entry before any archive data is trusted or extracted.

read_zip_entry

Reads one small metadata entry without extracting the surrounding archive.

read_zip_entry_text

Reads one small metadata entry as UTF-8 text.