Go: zip-slip FP / missed a zip-slip guard in argoproj/argo-cd

https://github.com/github/codeql/blob/590e93d8edec4d7216935ed4425a7ab77b3b2f34/go/ql/src/Security/CWE-022/ZipSlip.ql#L22-L23

Here's my fork's report:
https://github.com/check-spelling-sandbox/argo-cd/security/code-scanning/4

---

Arbitrary file access during archive extraction ("Zip Slip")

Code snippet
[util/io/files/tar.go:75](https://github.com/check-spelling-sandbox/argo-cd/blob/4014cc8b040f55dc698295d658cf0eb780ea7203/util/io/files/tar.go#L75-L75)
```go
tr := tar.NewReader(lr)

for {
header, err := tr.Next()
```
> Unsanitized archive entry, which may contain '..', is used in a .

---

Here's the accused flow:

Arbitrary file access during archive extraction ("Zip Slip")
Step 1 ... := ...[0]
Source
[util/io/files/tar.go:75](https://github.com/check-spelling-sandbox/argo-cd/blob/4014cc8b040f55dc698295d658cf0eb780ea7203/util/io/files/tar.go#L75-L75)
```go
tr := tar.NewReader(lr)

for {
header, err := tr.Next()
```
> Unsanitized archive entry, which may contain '..', is used in a .
> Unsanitized archive entry, which may contain '..', is used in a .
> Unsanitized archive entry, which may contain '..', is used in a .
```go
if err != nil {
if err == io.EOF {
break
```
Step 2 selection of Name
[util/io/files/tar.go:86](https://github.com/check-spelling-sandbox/argo-cd/blob/4014cc8b040f55dc698295d658cf0eb780ea7203/util/io/files/tar.go#L86-L86)
```go
continue
}

target := filepath.Join(dstPath, header.Name)
```
> [!NOTE]
> There _is_ a check for zip-slip right here in the form of [Inbound](https://github.com/argoproj/argo-cd/blob/b8249567ae1afe657f3d2f235dc3724880c91370/util/io/files/util.go#L75-L94):
```go
// Sanity check to protect against zip-slip
if !Inbound(target, dstPath) {
return fmt.Errorf("illegal filepath in archive: %s", target)
```
Step 3 call to Join
[util/io/files/tar.go:86](https://github.com/check-spelling-sandbox/argo-cd/blob/4014cc8b040f55dc698295d658cf0eb780ea7203/util/io/files/tar.go#L86-L86)
```go
continue
}

target := filepath.Join(dstPath, header.Name)
// Sanity check to protect against zip-slip
if !Inbound(target, dstPath) {
return fmt.Errorf("illegal filepath in archive: %s", target)
```
Step 4 target
Sink
[util/io/files/tar.go:98](https://github.com/check-spelling-sandbox/argo-cd/blob/4014cc8b040f55dc698295d658cf0eb780ea7203/util/io/files/tar.go#L98-L98)
```go
if preserveFileMode {
mode = os.FileMode(header.Mode)
}
err := os.MkdirAll(target, mode)
if err != nil {
return fmt.Errorf("error creating nested folders: %w", err)
}
```

Bắt đầu với go/ql/src/Security/CWE-022/ZipSlip.ql quanh dòng 22–23, sau đó tái hiện báo cáo đối với util/io/files/tar.go. Đọc util/io/files/util.go và kiểm tra Inbound của nó để so sánh phân tích luồng của query với việc trích xuất archive có bảo vệ. Hoàn tất khi hành vi của query khớp với trạng thái false-positive hoặc missed-guard của ví dụ này.

Do mô hình lập chỉ mục viết ra từ nội dung của issue.