Security fixes, thread safety, and complete data provider actions

[davidnich]

Summary

• Add thread-safe access to ZipFile operations using QoreRWLock
• Add reference counting between ZipFile and streams to prevent use-after-free
• Add path traversal validation to prevent Zip Slip attacks
• Add configurable max allocation size (ZIP_DEFAULT_MAX_ALLOC_SIZE)
• Fix toData() to properly close and clean up memory stream
• Add OpenSSL 3.2+ compatibility patch for minizip-ng
• Complete implementation of all 8 ZipDataProvider action providers
• Add GitLab CI configuration for ubuntu and alpine testing
• Add comprehensive tests (27 test cases, 180 assertions)
• Valgrind clean: 0 bytes leaked

Test plan

• Run zip.qtest - 15 test cases, 76 assertions pass
• Run ZipDataProvider.qtest - 12 test cases, 104 assertions pass
• Run valgrind memory check - no leaks detected
• CI should run ubuntu and alpine tests automatically

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR implements comprehensive security improvements, thread safety, and completes the data provider action implementations for the ZIP module. The changes add critical security protections against Zip Slip attacks, introduce thread-safe archive operations with proper reference counting between ZipFile and streams, and complete all 8 ZipDataProvider action providers.

Key Changes

• Added thread-safe access to ZipFile operations using read-write locks with reference counting to prevent use-after-free when streams are active
• Implemented path traversal validation to prevent Zip Slip security vulnerabilities in extraction operations
• Completed implementation of all 8 ZipDataProvider action providers (create, extract, list, info, add, extract-file, compress, decompress) with full request/response type definitions

Reviewed changes

Copilot reviewed 14 out of 14 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
test/zip.qtest	Added 5 new test cases covering security (path traversal), active stream reference counting, toData state management, delete behavior, and encryption with passwords
test/ZipDataProvider.qtest	Added 8 new test cases for all data provider actions with comprehensive validation of request/response handling
test/docker_test/test-ubuntu.sh	Updated file existence check to use new source file name QoreZipFile.cpp
test/docker_test/test-alpine.sh	Updated file existence check to use new source file name QoreZipFile.cpp
src/ZipOutputStream.h	Added parent reference for stream lifecycle management and updated constructor signature
src/ZipOutputStream.cpp	Implemented reference counting with parent ZipFile to track active streams
src/ZipInputStream.h	Added parent reference for stream lifecycle management and updated constructor signature
src/ZipInputStream.cpp	Implemented reference counting with parent ZipFile to track active streams
src/QoreZipFile.h	Added thread safety with QoreRWLock, atomic stream counter, max allocation size, and path validation
src/QoreZipFile.cpp	Implemented thread-safe operations with locking, path traversal security checks, active stream validation, and proper toData cleanup
qlib/ZipDataProvider/ZipDataProvider.qm	Completed all 8 action provider implementations, removed placeholder providers, added comprehensive request/response type definitions
patches/openssl-3.2-fix.patch	Added OpenSSL 3.2+ compatibility patch for minizip-ng ENGINE API deprecation
CMakeLists.txt	Added patch application logic for OpenSSL 3.2 compatibility
.gitlab-ci.yml	Added GIT_SUBMODULE_STRATEGY to ensure submodules are cloned

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Using write lock for a read operation is incorrect. The openInputStream method only needs a read lock since it's accessing the archive for reading purposes. This will unnecessarily block other threads from performing concurrent read operations. Change QoreAutoRWWriteLocker to QoreAutoRWReadLocker.

Suggested change

	QoreAutoRWWriteLocker lock(rwlock);
	QoreAutoRWReadLocker lock(rwlock);

[Copilot]

The patch application logic treats result code 1 (already applied) as success, which is correct. However, the comment says "Result 0 = success, 1 = already applied (which is fine)" but the condition checks if(PATCH_RESULT GREATER 1), which means it will warn for any result > 1. This is correct, but it would be clearer to document what other error codes might be returned (e.g., 2 for errors). Consider adding a more informative warning message that includes the actual error code.

Suggested change

	# Result 0 = success, 1 = already applied (which is fine)
	if(PATCH_RESULT GREATER 1)
	message(WARNING "Failed to apply OpenSSL 3.2 compatibility patch")
	# Result 0 = success, 1 = already applied (treated as success), >1 = error (e.g., 2 for patch failure)
	if(PATCH_RESULT GREATER 1)
	message(WARNING "Failed to apply OpenSSL 3.2 compatibility patch (patch exit code: ${PATCH_RESULT})")