Fix cifar vulnerability

[monindersingh]

Fix tar-slip and pickle deserialization vulnerabilities in CIFAR loader

Security fix for aix360/datasets/cifar_dataset.py (HIGH, 7.8)
CWE-22 (path traversal / tar-slip) + CWE-502 (untrusted deserialization)

Root cause

_download_data() fetched cifar-10-python.tar.gz over the network and then:

• called tar.extractall() with no member validation, allowing a malicious
  or MITM'd archive to write files outside the target directory (tar-slip),
  and
• _process_data() loaded the extracted batch files with pickle.load(), which
  executes arbitrary code if the archive was tampered with.
  Both risks share one root cause: the downloaded archive was never verified to
  be authentic before its contents were trusted.

Changes

1. Archive integrity verification (CWE-502)

   • Added CIFAR10_ARCHIVE_SHA256, pinned to the digest of the authentic
     archive. The pinned value was computed from a downloaded copy only after
     verifying it against the vendor-published MD5
     (c58f30108f718f92721af3b95e74349a).
   • _download_data() now hashes the downloaded archive (_sha256_of_file) and
     compares it to the pin BEFORE any extraction or pickle load. On mismatch
     it deletes the archive and raises (fail-closed). Because the pickle format
     is intrinsic to the CIFAR-10 release, provenance verification is the
     appropriate mitigation.

2. Safe tar extraction (CWE-22)

   • Added _safe_extract(), which validates every member resolves inside the
     target directory and rejects symlink/hardlink members whose targets escape
     it, then extracts using the tarfile 'data' filter (Python 3.12+) with a
     fallback for older Python versions.
   • Added _is_within_directory(), which compares on a path-separator boundary
     (not a raw string prefix) so a sibling such as /a/bad is not treated as
     being inside /a/b.
   • On any extraction failure, partially-extracted contents and the archive
     are removed before re-raising.

3. scikit-learn compatibility (not security-related; same file)

   • OneHotEncoder(sparse=False) fails on scikit-learn >= 1.2, where the
     argument was renamed to sparse_output. Routed both call sites through a
     version-agnostic _onehot_dense() helper so the loader runs across
     scikit-learn versions.

Verification

Exercised end-to-end against the genuine archive:

• authentic archive verifies, extracts, and processes the full pipeline;
  produces all six JSON outputs with correct shapes ((30000,32,32,3) and
  (30000,10)) and cleans up the archive and batch directory afterward;
• a tampered archive is rejected with a clear SHA-256 mismatch error and the
  bad file is removed;
• a tar member with a traversal path is rejected and no file is written
  outside the target directory.

Files changed

aix360/datasets/cifar_dataset.py

[vijay-arya]

@monindersingh could you pls make this minor change to avoid the DCO failure.

[monindersingh]

@vijay-arya I tried to follow the instructions and the error is gone. But now my PR shows 13 commits, 20 changed files....don't know if that is correct? I synched my base with main before following the instructions to avoid the DCO failure.