Fix Zip-Slip via validate/extract path-normalization mismatch in nltk.pathsec (CWE-22 / CWE-59)

Description

nltk.pathsec.ZipFile is the hardened ZIP extractor used across NLTK. For each
member it calls the centralized validator validate_zip_archive() to enforce
that the member stays within the extraction root, then calls the standard-library
extractor to write the file. The two steps normalize a member path containing a
.. component differently, so the path that is validated is not the path that is
written.

• validate_zip_archive computes member_path = (target / name_str).resolve(),
  and Path.resolve() collapses a .. against its preceding component:
  a/../b/evil.txt → <root>/b/evil.txt.
• zipfile.ZipFile.extract instead drops the empty / . / .. components
  and keeps the rest: a/../b/evil.txt → <root>/a/b/evil.txt.

So the validator inspects <root>/b/evil.txt (not a symlink → "contained" →
allowed), while the extractor writes to <root>/a/b/evil.txt. If <root>/a/b is
a pre-existing symlink pointing outside the extraction root, the write
follows the symlink and lands outside the root with fully attacker-controlled
content, while the centralized Zip-Slip check raised nothing.

Because validate_zip_archive is the centralized Zip-Slip sentinel, the mismatch
affects every caller of pathsec.ZipFile.extract / .extractall, not a
single extraction site.

The fix

The divergence only ever arises from absolute, drive-qualified, or
..-bearing member names — the exact shapes a legitimate archive never uses,
and the shapes the hardened extractor already promises to proactively block
(see nltk/test/unit/test_pathsec.py::test_zip_slip_traversal /
::test_zip_slip_absolute_path). Rather than try to keep two different
normalizations in lock-step, reject those members outright:

def _zip_member_is_unsafe(name_str):
    normalized = name_str.replace("\\", "/") if os.path.altsep else name_str
    if os.path.splitdrive(name_str)[0] or normalized.startswith("/"):
        return True
    return os.path.pardir in normalized.split("/")

member_path = (target / name_str).resolve()
if _zip_member_is_unsafe(name_str) or not (
    member_path == target or member_path.is_relative_to(target)
):
    # ... raise PermissionError (ENFORCE) / warn

This keeps the existing symlink-resolving containment check — which already
catches a pure-symlink escape such as a/b/x where <root>/a/b is a symlink
(no .. needed) — and adds the component check that closes the .. / absolute
gap. The two together guarantee the validated decision matches the written
location.

Behaviour

Reproduction

poc_validate_zip_archive_mismatch.py plants <root>/a/b → outside, builds an
archive whose member is a/../b/evil.txt, and calls
pathsec.ZipFile.extract(...):

• Before: validate_zip_archive raises nothing and
  <outside>/evil.txt is created with b"PWNED-OUTSIDE-EXTRACTION-ROOT".
• After: PermissionError: Security Violation [ZipAudit]: Traversal member 'a/../b/evil.txt' detected. and nothing is written outside the root.

Testing

• poc_validate_zip_archive_mismatch.py — escape now blocked, no out-of-root write.
• verify_pathsec_fix.py — escape blocked; classic ../ and absolute members
  still blocked; benign nested archives extract fully (no false positives).
• pytest nltk/test/unit/test_pathsec.py nltk/test/unit/test_nkjp_security.py nltk/test/unit/test_framenet_security.py nltk/test/unit/test_downloader_atomic.py nltk/test/unit/test_corpus_reader.py — 58 passed (this includes the
  pre-existing test_zip_slip_traversal / test_zip_slip_absolute_path).
• black==25.11.0 and ruff==0.15.6 (repo-pinned) — clean.