Fix case-sensitive extraction on Windows

[iremyux]

Use ordinal comparisons when validating extraction paths for TAR extraction.

Fixes #133345

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
13 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @dotnet/area-system-formats-tar
See info in area-owners.md if you want to be subscribed.

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Note

This error may be related to your runner configuration. You can now configure runners for Copilot code review separately from Copilot cloud agent by creating a copilot-code-review.yml file with your setup steps. Read the docs for details.

[Copilot]

🔵 Needs a closer look

One or more issues must be addressed before approval.

Review details

Suppressed comments (2)

src/libraries/System.Formats.Tar/src/System/Formats/Tar/TarEntry.cs:442

• The ordinal change is security-sensitive, but the old rationale for the platform-dependent comparison was removed without documenting why ordinal matching is intentional. Please add a brief explanation that this must remain ordinal to support case-sensitive Windows directories; otherwise a future cleanup may restore PathInternal.StringComparison and reintroduce the bug.

            if (!normalizedFile.StartsWith(logicalPrefix, StringComparison.Ordinal) &&
                !normalizedFile.Equals(logicalDest, StringComparison.Ordinal))

src/libraries/System.Formats.Tar/src/System/Formats/Tar/TarEntry.cs:522

• The added cases only verify the early GetFullDestinationPath rejection; they do not cover valid normalized paths such as subdir/../file or ./, nor exercise the changed symlink-walk comparisons. Please add sync and async positive coverage so this stricter ordinal validation cannot regress legitimate in-root extraction while fixing the case-only sibling case.

            return fullPath.StartsWith(destinationDirectoryFullPath, StringComparison.Ordinal) ? fullPath : null;

• Files reviewed: 3/3 changed files
• Comments generated: 0 new
• Review effort level: Lite