The current check (JENKINS-56931) using String.startsWith() fails to detect a corner case when zip entries have the same path prefix with the target location because the value returned by File.getCanonicalPath() doesn't end with a slash.
eg: /foobar is a subdirectory of /foo