Fix Fortify security scanning

* Arbitrary file access during archive extraction ("Zip Slip")
Issue: 207277

Author: iroqueta

gxcompress/src/main/java/com/genexus/compression/GXCompressor.java

@@ -588,6 +588,9 @@ private static void decompressZip(File archive, String directory) throws IOExcep
 			ZipEntry zipEntry;
 			while ((zipEntry = zis.getNextEntry()) != null) {
 				File newFile = new File(directory, zipEntry.getName());
+				if (HasZipSlipVulnerability(newFile, directory)) {
+					throw new IOException("Bad tar entry: " + zipEntry.getName());
+				}
 				if (zipEntry.isDirectory()) {
 					if (!newFile.isDirectory() && !newFile.mkdirs()) {
 						throw new IOException("Failed to create directory " + newFile);
@@ -614,6 +617,9 @@ private static void decompress7z(File archive, String directory) throws IOExcept
 			SevenZArchiveEntry entry;
 			while ((entry = sevenZFile.getNextEntry()) != null) {
 				File newFile = new File(directory, entry.getName());
+				if (HasZipSlipVulnerability(newFile, directory)) {
+					throw new IOException("Bad tar entry: " + entry.getName());
+				}
 				if (entry.isDirectory()) {
 					if (!newFile.isDirectory() && !newFile.mkdirs()) {
 						throw new IOException("Failed to create directory " + newFile);
@@ -640,6 +646,9 @@ private static void decompressTar(File archive, String directory) throws IOExcep
 			TarArchiveEntry entry;
 			while ((entry = tis.getNextEntry()) != null) {
 				File newFile = new File(directory, entry.getName());
+				if (HasZipSlipVulnerability(newFile, directory)) {
+					throw new IOException("Bad tar entry: " + entry.getName());
+				}
 				if (entry.isDirectory()) {
 					if (!newFile.isDirectory() && !newFile.mkdirs()) {
 						throw new IOException("Failed to create directory " + newFile);
@@ -787,4 +796,12 @@ private static void decompressJar(File archive, String directory) throws IOExcep
 			}
 		}
 	}
+
+	// Check for Zip Slip vulnerability: ensure extracted file remains within target directory
+	// Use Path.normalize() and Path.startsWith()
+	private static boolean HasZipSlipVulnerability(File file, String directory) {
+		java.nio.file.Path destDirPath = new File(directory).toPath().toAbsolutePath().normalize();
+		java.nio.file.Path newFilePath = file.toPath().toAbsolutePath().normalize();
+		return !newFilePath.startsWith(destDirPath);
+	}
 }