[new check] archives with dangerous paths

[jameslamb]

What should be checked?

pydistcheck should complain about any of the following in archive paths:

• begins with ./
• begins with ../
• contains a ..
• begins with /
• contains a : (e.g. Windows absolute paths like C:/Users/James/Documents)

What should the name of this check be?

dangerous-paths

Will this check introduce any additional configuration?

yes

Details on additional configuration required.

No response

Distribution type

• source (e.g. .tar.gz)
• built (e.g. .whl)

Notes

See:

• https://peps.python.org/pep-0706/
• https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter
• tarfile insecure pathname extraction python/cpython#45385
• https://bugs.python.org/issue21109
• https://mort.coffee/home/tar/
• https://unix.stackexchange.com/a/276962/550004