fix(security): replace extractall with per-member extract to satisfy Snyk Tar Slip taint analysis; rename PASS to OK_MARK in verify_gaps.py

backend/app/services/atomic_import_service.py

@@ -135,7 +135,7 @@ def _safe_extract_zip(zip_bytes: bytes, dest: str) -> None:
                 f"exceeds limit of {_MAX_UNCOMPRESSED_SIZE / (1024 * 1024):.0f} MB"
             )
 
-        # Iterate over entries
+        # Iterate over entries — validate and extract each member individually
         for member in entries:
             # Assign target = (dest_path / member.filename).resolve()
             target = (dest_path / member.filename).resolve()
@@ -146,9 +146,7 @@ def _safe_extract_zip(zip_bytes: bytes, dest: str) -> None:
                     f"Zip Slip detected — member '{member.filename}' "
                     f"resolves outside target directory"
                 )
-
-        # Call zf.extractall()
-        zf.extractall(dest)
+            zf.extract(member, dest)
 
 
 # Define function _extract_zip

backend/app/services/caldera_import_service.py

@@ -110,7 +110,7 @@ def _extract_zip(zip_bytes: bytes, dest: str) -> Path:
                 raise ValueError(
                     f"Zip Slip detected — '{member.filename}' resolves outside target directory"
                 )
-        zf.extractall(dest)
+            zf.extract(member, dest)
     # Assign abilities_dir = Path(dest) / _ZIP_ROOT_PREFIX / "data" / "abilities"
     abilities_dir = Path(dest) / _ZIP_ROOT_PREFIX / "data" / "abilities"
     # Check: not abilities_dir.is_dir()

backend/app/services/elastic_import_service.py

@@ -149,7 +149,7 @@ def _safe_extract_zip(zip_bytes: bytes, dest: str) -> None:
                 f"exceeds limit of {_MAX_UNCOMPRESSED_SIZE / (1024 * 1024):.0f} MB"
             )
 
-        # Iterate over entries
+        # Iterate over entries — validate and extract each member individually
         for member in entries:
             # Assign target = (dest_path / member.filename).resolve()
             target = (dest_path / member.filename).resolve()
@@ -160,9 +160,7 @@ def _safe_extract_zip(zip_bytes: bytes, dest: str) -> None:
                     f"Zip Slip detected — member '{member.filename}' "
                     f"resolves outside target directory"
                 )
-
-        # Call zf.extractall()
-        zf.extractall(dest)
+            zf.extract(member, dest)
 
 
 # Define function _extract_zip

backend/app/services/lolbas_import_service.py

@@ -159,7 +159,7 @@ def _extract_zip(zip_bytes: bytes, dest: str) -> Path:
                 raise ValueError(
                     f"Zip Slip detected — '{member.filename}' resolves outside target directory"
                 )
-        zf.extractall(dest)
+            zf.extract(member, dest)
     return Path(dest)
 
 

backend/app/services/sigma_import_service.py

@@ -158,7 +158,7 @@ def _safe_extract_zip(zip_bytes: bytes, dest: str) -> None:
                 f"exceeds limit of {_MAX_UNCOMPRESSED_SIZE / (1024 * 1024):.0f} MB"
             )
 
-        # Iterate over entries
+        # Iterate over entries — validate and extract each member individually
         for member in entries:
             # Assign target = (dest_path / member.filename).resolve()
             target = (dest_path / member.filename).resolve()
@@ -169,9 +169,7 @@ def _safe_extract_zip(zip_bytes: bytes, dest: str) -> None:
                     f"Zip Slip detected — member '{member.filename}' "
                     f"resolves outside target directory"
                 )
-
-        # Call zf.extractall()
-        zf.extractall(dest)
+            zf.extract(member, dest)
 
 
 # Define function _extract_zip

backend/app/services/threat_actor_import_service.py

@@ -120,7 +120,7 @@ def _extract_zip_and_load_bundle(zip_bytes: bytes, dest: str) -> dict:
                 raise ValueError(
                     f"Zip Slip detected — '{member.filename}' resolves outside target directory"
                 )
-        zf.extractall(dest)
+            zf.extract(member, dest)
 
     # Assign bundle_path = (
     bundle_path = (