Repair an archive import boundary
Requires Python 3.11+. No extra packages.

Reference solution: not included here, so the exercise does not hand you the answer.
Attempt the repair first. Then download archive-extraction-solution.zip from the project card
on https://softwaresecurity.com/labs/#project-archive-extraction and extract it into this folder;
it adds reference.py without changing your files, and the reference commands below
need it.

1. Run python3 -m unittest -v test_archive.py. Read the unsafe-name and symlink failures.
2. Edit allow_entry in exercise.py. Accept nested relative file paths; reject dot/empty segments, absolute/drive paths, control characters and symbolic links.
3. Run the tests again. The test extracts an actual ZIP in a new temporary directory and checks its contents. A failed import must clean up its private staging files and publish no output.
4. Inspect reference.py and compare each condition to its test. Run EXERCISE_MODULE=reference python3 -m unittest -v test_archive.py to check the reference separately.

Seven tests include a mixed valid/invalid archive, duplicate names, entry count and aggregate expansion. The harness also enforces a final destination check, duplicate rejection and small expanded-byte/count budgets. It never deliberately writes outside its temporary directory, even when the learner policy is wrong. It assumes a newly created directory inaccessible to other writers; a production filesystem threat model must address races, pre-existing links, case folding and platform behavior. Temporary files are removed automatically.

Dev container
.devcontainer/devcontainer.json opens this folder in VS Code Dev Containers or
GitHub Codespaces using the Dev Containers Python 3.13 image (Debian 13, Expat
2.8), pinned by digest. Run the commands above in its terminal.
