docs: Zipfile contains a 13-years outdated warning regarding path sanitization

Documentation

The extract/extractall documentation contains a warning that became outdated 13 years ago:

https://docs.python.org/3/library/zipfile.html#zipfile.ZipFile.extractall

"Warning: Never extract archives from untrusted sources without prior inspection. It is possible that files are created outside of path, for example, members that have absolute filenames or filenames with “..” components. This module attempts to prevent that. See extract() note."

This incorrect and completely outdated comment should have been deleted when the malicious zip sanitization was added to Python 13 years ago, in February 2013:

https://github.com/python/cpython/commit/b47acbf46abd425f69dcc03e9b4f0c7f7c321ac2

Here's the official Python code:

https://github.com/python/cpython/blob/main/Lib/zipfile/__init__.py#L2467

Both extract() and extractall() use _extract_member, which performs complete sanitizing:

# 1. Strips leading slashes (/), drive letters (C:), and UNC paths (\\server\share)
drive, root, arcname = os.path.splitroot(arcname)
...
# 2. Defines invalid parts: empty strings, current directory (.), and parent directory (..)
invalid_path_parts = ('', os.path.curdir, os.path.pardir)

# 3. Filters out any occurrences of '.' and '..'
arcname = os.path.sep.join(x for x in arcname.split(os.path.sep)
                           if x not in invalid_path_parts)

And even the original Zip Slip author said that Python is not vulnerable:

https://security.snyk.io/research/zip-slip-vulnerability

"We also vetted the Ruby and Python ecosystems and couldn’t find any vulnerable code snippets or libraries. In fact, Python libraries were vulnerable until fixed in 2014. Ruby has a number of existing vulnerabilities that have been fixed in previous versions here , here and here."

(He's wrong about 2014; Python added the malicious Zip path sanitization in February 2013.)

從 issue 中連結的 ZipFile.extractall 文件開始，並檢視 Lib/zipfile/init.py 中相關的 _extract_member 實作。移除過時的路徑清理警告，然後建置或驗證文件，以確認對 extract() 和 extractall() 的參照仍然正確。