FLAW022 — Zip-slip. Extracting archive entries whose names contain
.. lets the attacker write outside the target directory.
Constants
PATTERNS = [/
File\.open\s*\(\s*
File\.join\([^)]*\bentry\.(?:name|filename|path)\b/, /
File\.write\s*\(\s*
File\.join\([^)]*\bentry\.(?:name|filename|path)\b/, /
Dir\.mkdir\s*\(\s*
File\.join\([^)]*\bentry\.(?:name|filename|path)\b/]
File.open(File.join(dest, entry.name), "w") without prior check