Fix path traversal vulnerability

[aidy1991]

See https://nvd.nist.gov/vuln/detail/CVE-2007-4559

extractall() of tarfile has path traversal vulnerability. We need to check file path before using extractall() to avoid it.
If we need to add a unit test for this, please let me know. I added a unit test.

How to reproduce

1. Create tar file by below codes
2. Extract the tar file by right click menu of jupyter-archive
3. /tmp/test will be created (After this PR, the request of extracting will be failed as 400 bad request)

import tarfile
open("test", 'a').close()
tf = tarfile.open("test.tar.gz", "w:gz")
tf.add("test", "../../../../../../../../../../tmp/test")
tf.close()

Unrelated to this PR, is it the intended behavior that the user is not notified of an error when an extract request fails?

[github-actions]

👈 Launch a binder notebook on branch aidy1991/jupyter-archive/fix-path-traversal

[fcollonval]

Thanks @aidy1991 I have a suggestion.

Regarding reporting an error - this is a very good suggestion. Feel free to open a PR for it (I can provide some pointers if needed).

[fcollonval]

We could parametrize this test to add also "../test".

[aidy1991]

I see, it looks good. I'll fix to use parametrize and add ../test

[aidy1991]

@fcollonval
Could you take another look?

Regarding reporting an error - this is a very good suggestion. Feel free to open a PR for it (I can provide some pointers if needed).

Okay, I will try to work on the issue.

[fcollonval]

🚀

[fcollonval]

Thanks @aidy1991

[aidy1991]

Thank you for your review 👍