Module containment 

Entry-path containment: the single decision point for whether an archive entry’s name (or a symlink’s target) may be written under a destination directory.

Pure and filesystem-free by design — see the module-level doc comments on each function for why.

Enums

NameRefusal

Why a filesystem refused a NAME: the one definition of “the filesystem refuses this name”, shared by extraction (which skips the entry) and the fuzz containment oracle (which cannot resolve such a link physically).

SymlinkVerdict

What extraction may do with one symlink entry, decided by classify_symlink_target. A genuine escape is not a verdict: it is Err(Error::UnsafePath), exit 7.

Functions

check_symlink_target

Refuses a symlink whose target would resolve outside dest.

classify_symlink_target

Decides one symlink entry named entry, to be created at link_path (what safe_join produced for it) pointing at target: create it, skip it, or refuse the extraction. The one owner of that rule — extraction, the hard-link-to-a-symlink path and the fuzz oracle’s lexical rule all ask it.

name_refused_by_filesystem

Whether e is the filesystem refusing a NAME, and why.

safe_join

Joins entry_name onto dest, refusing anything that escapes.