feat(download_lt/safe_zip): new secure way to extract ZIPs

[mdevolde]

feat(download_lt/safe_zip): new secure way to extract ZIPs

Why the pull request was made

This feature allows for reducing the risk of extracting unverified ZIPs files (non-verified hashes, as for snapshots).

Summary of changes

• New module safe_zip.py containing a class SafeZipExtractor that allows to safely extract ZIPs
• New ZIP size verification in download_lt.py
• New tests linked to these changes

Screenshots (if appropriate):

Not applicable.

How has this been tested?

Applied local tests (including new ones), tested downloading of multiple versions.

Resources

Not applicable.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update (changes to documentation only)
• Refactor / code style update (non-breaking change that improves code structure or readability)
• Tests / CI improvement (adding or updating tests or CI configuration only)
• Other (please describe):

Checklist

• Followed the project's contributing guidelines.
• Updated any relevant tests.
• Updated any relevant documentation.
• Added comments to your code where necessary.
• Formatted your code, run the linters, checked types and tests.

[Copilot]

Pull request overview

This PR hardens the LanguageTool ZIP download/extract flow against ZIP slip, symlink, zip-bomb, name-collision, and oversized-download attacks by introducing a dedicated SafeZipExtractor and adding HTTP download size validation in download_lt.py.

Changes:

• Adds language_tool_python/safe_zip.py with SafeZipLimits and SafeZipExtractor (path normalization, member-type checks, per-member and total size/ratio limits, two-stage extract via private temp dir).
• In download_lt.py: validates Content-Length, enforces MAX_DOWNLOAD_BYTES while streaming, switches all extraction sites (unzip_file, release/snapshot download()) to the safe extractor, and removes the snapshot rename fallback.
• Adds extensive new tests in tests/test_safe_zip.py and tests/test_download.py covering unsafe member names, symlinks, conflicts, ratio/size limits, and download size enforcement.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 2 comments.

File	Description
language_tool_python/safe_zip.py	New module implementing safe ZIP validation and extraction.
language_tool_python/download_lt.py	Wires the safe extractor into all unzip paths and adds streaming download size limits; removes snapshot directory rename.
tests/test_safe_zip.py	Comprehensive tests for the new safe extractor.
tests/test_download.py	New tests verifying download size and Content-Length validation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.