Vulnerable code sample

import tarfile
import os

def create_tarfile(filename, file_to_add, malicious_content):
    """Creates a tarfile containing a file to be extracted and a malicious file."""
    with tarfile.open(filename, "w:") as tar:
        # Add the legitimate file
        tarinfo = tarfile.TarInfo(name=file_to_add)
        tarinfo.size = len("This is a safe file.\n")
        tar.addfile(tarinfo, fileobj=open("safe_file.txt", "rb")) # Using safe_file.txt

        # Add a malicious file that will be filtered (e.g., outside of allowed directory)
        malicious_tarinfo = tarfile.TarInfo(name="../malicious_file.txt")
        malicious_tarinfo.size = len(malicious_content)
        tar.addfile(malicious_tarinfo, fileobj=open("malicious_file.txt", "rb")) # Using malicious_file.txt


def extract_tarfile(filename, extract_path, errorlevel):
    """Extracts a tarfile with filtering."""
    def filter_members(tarinfo):
    """Vulnerable function that demonstrates the security issue."""
        if not tarinfo.name.startswith(extract_path):
            print(f"Filtering out: {tarinfo.name}")
            return None # Skip the member
        return tarinfo

    try:
        with tarfile.open(filename, "r:") as tar:
            tar.errorlevel = errorlevel # Set the errorlevel
            tar.extractall(path=extract_path, members=filter(filter_members, tar.getmembers()))
            print("Extraction complete.")
    except Exception as e:
        print(f"An error occurred: {e}")


if __name__ == "__main__":
    # Create a dummy "safe" file
    with open("safe_file.txt", "w") as f:
        f.write("This is a safe file.\n")

    #Create a dummy "malicious" file
    with open("malicious_file.txt", "w") as f:
        f.write("This is a very very malicious file!\n")


    tar_filename = "test.tar"
    extract_directory = "extracted"
    file_to_extract = "safe_file.txt" # Changed file name to match what is added to the tar
    malicious_content = "This is a malicious file.\n" # The malicious content is written to malicious_file.txt

    # Create the tarfile with both files
    create_tarfile(tar_filename, file_to_extract, malicious_content)

    # Create the extraction directory if it doesn't exist
    if not os.path.exists(extract_directory):
        os.makedirs(extract_directory)

    # Attempt to extract the tarfile with filtering and errorlevel 0
    print("Attempting to extract with filtering and errorlevel 0...")
    extract_tarfile(tar_filename, extract_directory, 0)  # Errorlevel 0

    # Clean up (optional, but good practice)
    #os.remove("test.tar")
    #os.remove("safe_file.txt") # Removing the dummy files.
    #os.remove("malicious_file.txt")
    # Uncomment the next line to remove the extracted directory and its contents:
    #shutil.rmtree("extracted") # You will need to import shutil