fix: use subprocess instead of os.system in dataset_download.py

[orbisai0security]

Summary

Fix high severity security issue in research/delf/delf/python/datasets/sfm120k/dataset_download.py.

Vulnerability

Field	Value
ID	V-007
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-007
File	research/delf/delf/python/datasets/sfm120k/dataset_download.py:54
CWE	CWE-22

Description: The dataset_download.py script extracts downloaded tar archives using os.system() with the tar command, without validating archive member paths before extraction. A malicious tar archive can contain entries with path traversal sequences (e.g., ../../etc/cron.d/backdoor) that cause tar to write files outside the intended destination directory. This 'Tar Slip' vulnerability allows an attacker who can serve a malicious archive (via a compromised CDN, DNS hijacking, or man-in-the-middle attack) to write arbitrary files anywhere on the host filesystem accessible to the running process.

Changes

• research/delf/delf/python/datasets/sfm120k/dataset_download.py

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security