PathGuard

Zip-Slip / path-traversal defence (Snyk 2018; CVE-2020-8913; CVE-2023-35947; Android "Zip Path Traversal"). Every entry name read out of an archive MUST pass through sanitize before it is joined to an output directory.

The guard rejects, by default and impossible to forget:

• empty names and names containing NUL or control characters,

• absolute paths (/foo) and Windows drive-letter paths (C:\foo),

• any .. traversal segment (rejected outright, not just resolved),

• backslash separators (normalised, then re-checked).

It returns a clean, forward-slash relative path safe to resolve under a root. (Spaces in names are allowed. Only control characters and NUL are rejected.)