I'm not sure this handle the case of bogus zip files very well. 

In theory, the paths here could be things like "../../../etc/foo", and extend outside
of the intended dir. See notes at http://docs.python.org/2/library/zipfile#zipfile.ZipFile.extractall

On a related note, there doesn't seem to be any test cases for the manifest reading code. Since this
patch has to reimplement parts of zipfile that the docs indicated is trouble prone, we definitely need
some tests cases for this.