title: Extract untrusted tarball safely in Python
body: <p>In the doc for <a href="https://docs.python.org/2/library/tarfile.html#tarfile.TarFile.extractall" rel="nofollow">tarfile.extractall</a> it says </p>
  
  <blockquote>
    <p>Never extract archives from untrusted sources without prior inspection. It is possible that files are created outside of path, e.g. members that have absolute filenames starting with "/" or filenames with two dots "..".</p>
  </blockquote>
  
  <p>Some posts on the web or stackoverflow address these vulnerabilities, however, I can still think of another case, e.g. a tarball with following two files:</p>
  
  <pre><code>A --&gt; /etc
  A/passwd
  </code></pre>
  
  <p>Entry <code>A</code> is a symbolic link and anything under <code>A</code> will be redirected to <code>/etc</code>, which can't be detected by most of the solutions on the web.</p>
  
  <p>My question is, besides this, there might be some other vulnerabilities I overlooked, so even if I had a piece of code that handles this, it might be still unsafe.  Is there a mature library of Python that can extract tarball safely?</p>