Fix path traversal check in tar extraction to use path-aware comparison

[Copilot]

os.path.commonprefix is string-based and can be bypassed — /tmp/dir_evil shares the prefix /tmp/dir, incorrectly passing the traversal check. Replaces it with os.path.commonpath, which compares at directory boundaries.

Changes

• is_within_directory: Replace os.path.commonprefix with os.path.commonpath([abs_directory, abs_target]) == abs_directory to correctly enforce path containment
• Error handling: Catch ValueError from os.path.commonpath (raised on Windows when paths span different drives) and return False — path is not within directory
• Exception type: Raise ValueError instead of bare Exception on traversal detection

# Before — bypassable
prefix = os.path.commonprefix([abs_directory, abs_target])
return prefix == abs_directory  # /tmp/dir_evil falsely matches /tmp/dir

# After — path-aware
try:
    return os.path.commonpath([abs_directory, abs_target]) == abs_directory
except ValueError:
    return False  # different drives on Windows → not within directory

---

🔒 GitHub Advanced Security automatically protects Copilot coding agent pull requests. You can protect all pull requests by enabling Advanced Security for your repositories. Learn more about Advanced Security.