Our rudimentary check for whether a file path is entirely contained under a directory had a false negative when the parent directory is "/".
To prevent zipslip, we verify that each extracted file would fall strictly under the prefix of the path to extract to. However, this yielded a false positive when extracting to `.`, which is the default for downloading a single archive.