onnxruntime

f1f04362 - fix(transformers): validate archive extraction paths (#28777)

fix(transformers): validate archive extraction paths (#28777) ## Summary This PR hardens TensorFlow checkpoint archive extraction in the transformer conversion utility by validating archive member paths before extraction and using Python's safe tar extraction filter when available. It also adds regression tests to confirm traversal-style archive members are rejected for both tar.gz and zip inputs. ## Key Changes - Added a shared safe extraction path for tar.gz and zip checkpoint archives in `onnxruntime/python/tools/transformers/convert_tf_models_to_pytorch.py`. - Replaced direct `extractall()` usage with path validation to prevent directory traversal outside the target checkpoint directory. - Added regression tests in `test_convert_tf_models_to_pytorch.py` to cover malicious `../` archive members. ## Testing - `./.venv/bin/python -m pytest test_convert_tf_models_to_pytorch.py` --------- Co-authored-by: tlwu <tlwu@example.com>