Add negative test cases for path-traversal protection in update.retrieve()

[Copilot]

The path-traversal protection in update.retrieve() lacked test coverage for failure paths, leaving the security-sensitive safe_extract logic unverified against regression.

Changes

• New helper _make_tarball_with_traversal — builds tar fixtures with controlled (malicious) member names for use in negative tests
• test_retrieve_path_traversal_raises — asserts ValueError is raised when a tar member uses a relative ../ escape path
• test_retrieve_absolute_path_in_tar_raises — asserts ValueError is raised when a tar member uses an absolute path (e.g. /etc/passwd) outside the target directory

def test_retrieve_path_traversal_raises(self):
    with tempfile.TemporaryDirectory() as tmpdir:
        fake_path = self._make_tarball_with_traversal(
            tmpdir, "traversal.tar", "../malicious.txt"
        )
        with patch("pyiri2016.api.update.wget.download", return_value=fake_path):
            with self.assertRaises(ValueError):
                update.retrieve("http://example.com", "traversal.tar", directory=tmpdir)

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.