From c0da9819199996f67e9c22baad49cf99588f45c5 Mon Sep 17 00:00:00 2001
From: Thomas Vilte <88698264+thomas-vilte@users.noreply.github.com>
Date: Fri, 31 Jul 2026 17:05:24 -0300
Subject: [PATCH] Potential fix for code scanning alert no. 2: Arbitrary file
 access during archive extraction ("Zip Slip")

Co-authored-by: Copilot Autofix powered by AI <62310815+github-advanced-security[bot]@users.noreply.github.com>
---
 internal/services/version_checker.go | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/internal/services/version_checker.go b/internal/services/version_checker.go
index 0294e32..8eb8e85 100644
--- a/internal/services/version_checker.go
+++ b/internal/services/version_checker.go
@@ -450,10 +450,22 @@ func (v *VersionUpdater) extractZip(archivePath, destDir string) (string, error)
 		}
 	}()
 
+	cleanDestDir, err := filepath.Abs(filepath.Clean(destDir))
+	if err != nil {
+		return "", err
+	}
+
 	var binaryPath string
 	binaryName := "matecommit.exe"
 	for _, f := range r.File {
-		target := filepath.Join(destDir, f.Name)
+		if filepath.IsAbs(f.Name) {
+			return "", fmt.Errorf("invalid archive entry path: %s", f.Name)
+		}
+
+		target := filepath.Clean(filepath.Join(cleanDestDir, f.Name))
+		if target != cleanDestDir && !strings.HasPrefix(target, cleanDestDir+string(os.PathSeparator)) {
+			return "", fmt.Errorf("invalid archive entry path: %s", f.Name)
+		}
 
 		if f.FileInfo().IsDir() {
 			_ = os.MkdirAll(target, 0755)