test(extract): cover path-traversal helpers

[devsy-app]

Package reviewed

pkg/extract (Docker/OCI image extraction — tar/gzip/zip path-traversal boundary).

Issue found

The package's security-critical helpers — withinDir, resolveLinkTarget, resolveRelativePath (incl. its StripLevels branches), and validateLinkTarget — are the boundary that blocks tar/zip-slip (path traversal, symlink traversal, hard-link traversal). They were only exercised indirectly through end-to-end Extract/UnzipFolder tests, with no direct coverage of their edge cases (sibling-prefix escapes, the exact-dest boundary, parent-dir rejection, absolute vs relative link targets, and the StripLevels strip-beyond-depth fallback). A regression in any of these pure functions could silently weaken the extraction boundary while the indirect tests still passed.

Change

Added pkg/extract/path_test.go with direct, table-driven unit tests (no behavioral change to production code):

• TestWithinDir — nested inside, exactly dest, deep inside, sibling-prefix outside (dest_evil), unrelated outside, parent dir.
• TestResolveLinkTarget — absolute target preserved, relative parent (../target), relative sibling.
• TestResolveRelativePath_StripLevels — no strip, strip one/two levels, strip beyond depth (remainder kept), strip to final segment.
• TestValidateLinkTarget — symlink inside allowed, symlink traversal blocked, hard-link traversal blocked.

Verification performed

• task cli:format — clean (gofmt/gci/gofumpt).
• task cli:lint:ci — 0 issues (new-from-patch against origin/main).
• task cli:test — pkg/extract passes (ok github.com/devsy-org/devsy/pkg/extract).
• The only failing package is pkg/git (TestRepoCloneFromInfoHelper), the documented known pre-existing failure on origin/main (stale LFS-config assertion), unrelated to this change — this PR does not touch pkg/git.
• go.mod/go.sum churn from cli:tidy was reverted so the diff contains only the new test file.

This PR was created by an AI agent as part of an automated daily package review job.

[netlify]

✅ Deploy Preview for images-devsy-sh canceled.

Name	Link
🔨 Latest commit	7bf95d3
🔍 Latest deploy log	https://app.netlify.com/projects/images-devsy-sh/deploys/6a82a7d0702834000898d42f

[netlify]

✅ Deploy Preview for devsydev canceled.

Name	Link
🔨 Latest commit	7bf95d3
🔍 Latest deploy log	https://app.netlify.com/projects/devsydev/deploys/6a82a7d03a764a0008a222ea

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 19 complexity · 0 duplication

Metric	Results
Complexity	19
Duplication	0

View in Codacy

AI Reviewer: run a review on demand. To trigger the first review automatically, go to your organization or repository integration settings. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}