An archive extractor turns bytes supplied by someone else into filesystem writes. That makes every extraction path a write primitive, even when the code never runs a shell command. Python's tarfile module now exposes a set of extraction filters for this problem, but a service still has to select one and keep that choice stable across supported Python versions.
The unsafe part is the destination path
A tar archive can contain ordinary files, symbolic links, hard links, device nodes, absolute paths, and members with .. components. An extractor that trusts those names can write outside the intended directory or create a link that makes a later write escape it. The archive format does not carry a promise that every member belongs under one clean root. The application has to enforce that rule.
The Python 3.12 documentation supplies tarfile.data_filter for data archives and also documents privileged filters for archives that need broader behavior. The data filter rejects paths that escape the destination, blocks unsafe links, and rejects special files. Applications that only need regular files and directories should prefer the narrower behavior.
Make the filter visible in the call
An explicit argument is easier to audit than a global side effect:
import tarfile
with tarfile.open(archive_path, "r:*") as archive:
archive.extractall(
path=destination,
filter="data",
)
Code that carries a custom policy can pass a callable instead. A callable should inspect the member and return either a safe replacement member or None. It should reject absolute paths, parent traversal, unexpected device files, and links whose resolved destination is outside the extraction root. Raising an exception is often clearer than silently skipping a hostile member because the caller then knows that the transaction did not complete as expected.
Version defaults still need an inventory
The filter interface is available on supported branches, but defaults differ by Python release. A service that relies on the interpreter default can behave differently after a base image upgrade. Use hasattr(tarfile, "data_filter") to check feature availability, then set extraction_filter or the filter argument explicitly in code. Do not use a version number as the only capability test when the runtime has been patched or rebuilt by a distribution.
There is another operational detail in the documentation: an extraction that aborts can leave a partial tree. Treat the destination as untrusted until the whole operation succeeds. Extract into a fresh staging directory, validate the resulting tree, and move it into place only after success. That prevents a failed request from leaving files at paths that a later process mistakes for valid state.
Controls that survive a retry
Use a dedicated unprivileged account for extraction. Mount the staging area with nodev, nosuid, and noexec when the extracted content does not need those capabilities. Apply a file count and total expanded size limit before accepting the request. Keep the archive and the extracted output on the same controlled volume so a rename is atomic. Log the parser version, selected filter, member count, expanded bytes, and failure reason.
These controls do not prove that every file is harmless. They make the extraction boundary predictable and give the next process a clean object to inspect. The filter is part of the security model, not a decoration on the extractall call.