Replace extract-zip with secure yauzl-based extraction

[brondani]

Fixes

• Remove direct dependency on extract-zip
• Enforce safe extraction by rejecting path traversal and symbolic-link ZIP entries while validating destination paths.
• Preserve safe replacement of regular destination files using temporary files.

Changes

• Replaced extract-zip with an in-repo yauzl-based ZIP extractor.
• Updated project archive extraction call sites to use the new utility.
• Added tests for regular extraction and archive path-safety handling.
• Added yauzl dependencies, TypeScript types, and third-party license records.
• Limit ZIP extraction resource usage (ZIP-bomb protections)

Checklist

• 🤖 This change is covered by unit tests (if applicable).
• 🤹 Manual testing has been performed.
• 🛡️ Security impacts have been considered (if relevant).
• 📖 Documentation updates are complete (if required).
• 🧠 Third-party dependencies and TPIP updated (if required).

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)
• ✅ 0 package(s) with incompatible licenses
• ✅ 0 package(s) with invalid SPDX license definitions
• ✅ 0 package(s) with unknown licenses.
• ⚠️ 1 packages with OpenSSF Scorecard issues.

See the Details below.

OpenSSF Scorecard

Package	Version	Score	Details
npm/pend	1.2.0	⚠️ 2	Details Check Score Reason Packaging ⚠️ -1 packaging workflow not detected Token-Permissions ⚠️ -1 No tokens found SAST ⚠️ 0 no SAST tool detected Pinned-Dependencies ⚠️ -1 no dependencies found Dangerous-Workflow ⚠️ -1 no workflows found Binary-Artifacts 🟢 10 no binaries found in the repo Code-Review ⚠️ 0 Found 0/13 approved changesets -- score normalized to 0 Maintained ⚠️ 0 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Security-Policy ⚠️ 0 security policy file not detected Fuzzing ⚠️ 0 project is not fuzzed License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches
npm/yauzl	3.4.0	🟢 3.7	Details Check Score Reason Maintained 🟢 9 6 commit(s) and 5 issue activity found in the last 90 days -- score normalized to 9 Code-Review ⚠️ 0 Found 0/26 approved changesets -- score normalized to 0 Token-Permissions ⚠️ 0 detected GitHub workflow tokens with excessive permissions Packaging ⚠️ -1 packaging workflow not detected Dangerous-Workflow 🟢 10 no dangerous workflow patterns detected Binary-Artifacts 🟢 10 no binaries found in the repo Pinned-Dependencies ⚠️ 0 dependency not pinned by hash detected -- score normalized to 0 CII-Best-Practices ⚠️ 0 no effort to earn an OpenSSF best practices badge detected Fuzzing ⚠️ 0 project is not fuzzed Security-Policy ⚠️ 0 security policy file not detected License 🟢 10 license file detected Signed-Releases ⚠️ -1 no releases found Branch-Protection ⚠️ 0 branch protection not enabled on development/release branches SAST ⚠️ 0 SAST tool is not run on all commits -- score normalized to 0
npm/@types/yauzl	^2.10.3	Unknown	Unknown

Scanned Files

• package-lock.json
• package.json

[qltysh]

Coverage Impact

⬆️ Merging this pull request will increase total coverage on main by 0.1%.

Modified Files with Diff Coverage (2)

Rating	File	% Diff	Uncovered Line #s
	src/data-manager/draft-project-data.ts	33.3%	110-215
	src/utils/extract-zip.ts	95.7%	87, 99, 118, 168, 206
	Total	94.1%

🤖 Increase coverage with AI coding...

In the `replace-extract-zip-secure` branch, add test coverage for this new code:

- `src/data-manager/draft-project-data.ts` -- Line 110-215
- `src/utils/extract-zip.ts` -- Lines 87, 99, 118, 168, and 206

🚦 See full report on Qlty Cloud »

🛟 Help

• Diff Coverage: Coverage for added or modified lines of code (excludes deleted files). Learn more.

• Total Coverage: Coverage for the whole repository, calculated as the sum of all File Coverage. Learn more.

• File Coverage: Covered Lines divided by Covered Lines plus Missed Lines. (Excludes non-executable lines including blank lines and comments.)

  • Indirect Changes: Changes to File Coverage for files that were not modified in this PR. Learn more.

[soumeh01]

LGTM

[jreineckearm]

@brondani , are there plans to move a variant of this to vsce-helper?

[brondani]

are there plans to move a variant of this to vsce-helper?

AFAIK this is not yet formally planned.
Would you prefer to drop this change and extend vsce-helper instead?

[jreineckearm]

If we extend vsce-helper, then we would get the goodness of this PR also for our CI downloads + unzip (and hence for other dependents of that). I believe it could still be used through the package in the production code here.