fix(Untar): ensure files are extracted inside the destination directory

[floreks]

• Verify target paths to prevent extraction outside the destination
• Add unit tests for validation of target path and content extraction within destination directory

Summary

Labels

Test Plan

Checklist

• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have added a meaningful title and summary to convey the impact of this PR to a user.
• I have added relevant labels to this PR to help with categorization for release notes.

[greptile-apps]

Greptile Summary

This PR keeps tar extraction inside the destination directory. The main changes are:

• Validates archive entry paths before extraction.
• Uses root-scoped file and directory operations.
• Adds tests for traversal, symlink escape, and normal extraction.

Confidence Score: 5/5

This looks safe to merge.

• The updated extraction path addresses the reported symlink escape.
• Extracting to the filesystem root no longer depends on a broken string-prefix check.
• No blocking issues were found in the changed code.

Important Files Changed

Filename	Overview
pkg/utils/tar.go	Adds path validation and root-scoped extraction to keep files within the destination.
pkg/utils/tar_test.go	Adds coverage for valid extraction, parent traversal, and pre-existing symlink escapes.

_{Reviews (2): Last reviewed commit: "fix(Untar): enhance path security and va..." | Re-trigger Greptile}

[floreks]

@greptileai