fix(extensions): use zipfile.is_zipfile for --from content guard

Replace the weak zip_data.startswith(b"PK") prefix check with
zipfile.is_zipfile() on a BytesIO so any non-ZIP payload (not just
those lacking the PK magic) is rejected with the friendly error before
install_from_zip can raise BadZipFile. Addresses PR review feedback.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: mnriem

src/specify_cli/extensions/_commands.py

@@ -482,6 +482,7 @@ def extension_add(
 
             elif from_url:
                 # Install from URL (ZIP file)
+                import io
                 import urllib.error
 
                 console.print(f"Downloading from {safe_url}...")
@@ -515,7 +516,7 @@ def extension_add(
                     ) as response:
                         zip_data = response.read()
 
-                    if not zip_data.startswith(b"PK"):
+                    if not zipfile.is_zipfile(io.BytesIO(zip_data)):
                         console.print(
                             f"[red]Error:[/red] {safe_url} did not return a ZIP archive "
                             f"(got {len(zip_data)} bytes). This usually means the request "

tests/test_extensions.py

@@ -40,6 +40,10 @@
     version_satisfies,
 )
 
+# Minimal valid ZIP (empty end-of-central-directory record). Passes
+# zipfile.is_zipfile() so --from download tests exercise the content guard.
+_MINIMAL_ZIP_BYTES = b"PK\x05\x06" + b"\x00" * 18
+
 
 def can_create_symlink(tmp_path: Path) -> bool:
     """Return True when the current platform/user can create file symlinks."""
@@ -5378,7 +5382,7 @@ def fake_install_from_zip(self_obj, zip_path, speckit_version, priority=10, forc
         runner = CliRunner()
         with patch.object(Path, "cwd", return_value=project_dir), \
              patch("typer.confirm", return_value=True), \
-             patch("specify_cli.authentication.http.open_url", return_value=FakeResponse(b"PK\x03\x04zip-bytes")), \
+             patch("specify_cli.authentication.http.open_url", return_value=FakeResponse(_MINIMAL_ZIP_BYTES)), \
              patch.object(ExtensionManager, "install_from_zip", fake_install_from_zip), \
              patch.object(ExtensionRegistry, "get", return_value={}):
             result = runner.invoke(
@@ -5514,7 +5518,7 @@ def fake_open_url(url, timeout=10, extra_headers=None, redirect_validator=None):
                 return FakeResponse(body)
             seen["url"] = url
             seen["headers"] = extra_headers
-            return FakeResponse(b"PK\x03\x04payload")
+            return FakeResponse(_MINIMAL_ZIP_BYTES)
 
         def fake_install(self_obj, zip_path, speckit_version, priority=10, force=False):
             return SimpleNamespace(
@@ -5615,7 +5619,7 @@ def fake_install_from_zip(self_obj, zip_path, speckit_version, priority=10, forc
         runner = CliRunner()
         with patch.object(Path, "cwd", return_value=project_dir), \
              patch("typer.confirm", return_value=True), \
-             patch("specify_cli.authentication.http.open_url", return_value=FakeResponse(b"PK\x03\x04zip-bytes")), \
+             patch("specify_cli.authentication.http.open_url", return_value=FakeResponse(_MINIMAL_ZIP_BYTES)), \
              patch.object(ExtensionManager, "install_from_zip", fake_install_from_zip):
             result = runner.invoke(
                 app,
@@ -5624,7 +5628,7 @@ def fake_install_from_zip(self_obj, zip_path, speckit_version, priority=10, forc
             )
 
         assert result.exit_code == 0
-        assert installed["zip_bytes"] == b"PK\x03\x04zip-bytes"
+        assert installed["zip_bytes"] == _MINIMAL_ZIP_BYTES
         assert installed["zip_path"].resolve().is_relative_to(downloads_dir.resolve())
         assert installed["zip_path"].name.startswith("extension-url-download-")
         assert not installed["zip_path"].exists()