fix(zip): never write through a symlink when extracting (#43910)

Author: yury-s

packages/playwright/src/reporters/blob.ts

@@ -84,9 +84,13 @@ export class BlobReporter extends TeleReporterEmitter {
       zipFinishPromise.resolve(undefined);
     }).on('error', error => zipFinishPromise.reject(error));
 
+    const addedEntries = new Set<string>();
     for (const { originalPath, zipEntryPath } of this._attachments) {
+      if (addedEntries.has(zipEntryPath))
+        continue;
       if (!fs.statSync(originalPath, { throwIfNoEntry: false })?.isFile())
         continue;
+      addedEntries.add(zipEntryPath);
       zipFile.addFile(originalPath, zipEntryPath);
     }
 

packages/utils/third_party/extractZip.ts

@@ -177,7 +177,10 @@ class Extractor {
       debug('creating symlink', link, dest);
       await fs.symlink(link, dest);
     } else {
-      await pipeline(readStream, createWriteStream(dest, { mode: procMode }));
+      // 'wx' fails when dest exists, including a symlink left by a previous entry.
+      // Otherwise an archive could place a symlink and then a regular file with the
+      // same name to write outside of the extraction directory.
+      await pipeline(readStream, createWriteStream(dest, { mode: procMode, flags: 'wx' }));
     }
   }