fix(security): prevent Zip Slip path traversal in harUnzip

[SebTardif]

Summary

Fixes #40622

The harUnzip() function in packages/playwright-core/src/server/localUtils.ts extracts zip entries using path.join(resourcesDir, entry) without validating that the resolved path stays inside resourcesDir. A crafted .har.zip file with entries containing path traversal sequences (e.g. ../../etc/cron.d/evil) could write files to arbitrary locations on the filesystem.

Fix

Added resolveWithinRoot() validation before writing each extracted zip entry, rejecting any entry whose resolved path escapes the target resourcesDir. This follows the exact same pattern already used in extractTrace() in packages/playwright-core/src/tools/trace/traceParser.ts:

const outPath = resolveWithinRoot(resourcesDir, entry);
if (!outPath)
  throw new Error(`HAR zip entry '${entry}' escapes output directory`);
await progress.race(fs.promises.writeFile(outPath, buffer));

Changes

• packages/playwright-core/src/server/localUtils.ts: Import resolveWithinRoot from @utils/fileUtils and add path containment check in harUnzip().

Test plan

The resolveWithinRoot() utility is already thoroughly tested via the existing extractTrace() codepath. The fix is a 3-line addition that rejects any zip entry with a relative path escaping the output directory (returns null for absolute paths and paths that resolve outside the root after normalization).

[github-actions]

Test results for "MCP"

2 failed
❌ [msedge] › mcp/dashboard.spec.ts:185 › should start dashboard and annotate when no dashboard is running @mcp-windows-latest-msedge
❌ [webkit] › mcp/config.ini.spec.ts:57 › ini config sets browser launch options @mcp-windows-latest-webkit

6941 passed, 1052 skipped

---

Merge workflow run.

[github-actions]

Test results for "tests 1"

41655 passed, 851 skipped

---

Merge workflow run.