Sanitize archive entry paths before writing
Archive extraction should not write entry names directly to the filesystem.
#Metadata
#Why it matters
Archive entries can contain traversal paths that overwrite files outside the intended extraction directory.
#Remediation
Normalize each entry path against a trusted extraction root and reject paths that escape it.
#Repository path
The generated metadata points to critiq-rules/libs/rules/catalog/rules/shared/security.archive-path-traversal.rule.yaml.