Patched code sample

import os
import zipfile
from pathlib import Path

def secure_extract_zip(zip_path, extract_to_dir):
    """
    Extracts a ZIP archive to a specified directory, preventing Zip Slip attacks.

    This function validates that each member's path is safely within the
    intended destination directory before extraction.
    """
    # Resolve the destination directory to an absolute path to establish a secure root.
    destination_root = Path(extract_to_dir).resolve()

    # Ensure the destination directory exists.
    destination_root.mkdir(parents=True, exist_ok=True)

    with zipfile.ZipFile(zip_path, 'r') as zf:
        for member_info in zf.infolist():
            # Skip directories
            if member_info.is_dir():
                continue

            # Construct the full intended destination path for the member.
            target_path = destination_root.joinpath(member_info.filename).resolve()

            # THE FIX:
            # Check if the resolved target path is still within the destination root.
            # This is done by verifying that the destination root is a parent of the
            # resolved target path. This check prevents traversal attacks (e.g., '../').
            try:
                target_path.relative_to(destination_root)
            except ValueError:
                # If relative_to fails, it means the path is outside the destination root.
                print(f"Malicious path detected, skipping file: {member_info.filename}")
                continue

            # If the path is safe, proceed with extraction.
            # Ensure parent directory for the file exists.
            target_path.parent.mkdir(parents=True, exist_ok=True)
            with zf.open(member_info) as source, open(target_path, "wb") as target:
                target.write(source.read())