Patched code sample

import os
import tarfile

def safe_extract_archive(tar_path, destination_dir):
    """
    Safely extracts a tar archive to a destination directory, preventing path
    traversal vulnerabilities.

    Args:
        tar_path (str): The path to the tar archive.
        destination_dir (str): The directory where contents should be extracted.
    """
    # Resolve the destination directory to an absolute path to establish a secure root.
    abs_destination_dir = os.path.abspath(destination_dir)

    with tarfile.open(tar_path, "r:*") as tar:
        for member in tar.getmembers():
            # Build the full, intended destination path for the member.
            member_destination = os.path.join(abs_destination_dir, member.name)

            # Normalize the path to resolve ".." components and other indirections.
            abs_member_destination = os.path.abspath(member_destination)

            # THE FIX:
            # Check if the resolved path of the member is still within the intended
            # destination directory. This prevents extraction outside of the secure root.
            if not abs_member_destination.startswith(abs_destination_dir + os.sep):
                # This check prevents writing files using paths like '../etc/passwd'.
                print(f"WARNING: Skipping unsafe member path '{member.name}'")
                continue

            # If the path is safe, proceed with extracting this specific member.
            # Using extract() on a per-member basis allows for this validation step,
            # unlike a blind extractall() call.
            tar.extract(member, path=destination_dir)