Patched code sample

import tarfile
from pathlib import Path


def _get_safe_members(tar: tarfile.TarFile, dest: Path) -> list[tarfile.TarInfo]:
    """
    Returns a list of TarInfo objects that are safe to extract.
    This check is a backport of the `data` filter from Python 3.12 for
    older, supported Python versions.
    """
    members: list[tarfile.TarInfo] = []
    dest_resolved = dest.resolve()

    for member in tar.getmembers():
        # Disallow dangerous member types (symlinks, device files, etc.).
        if member.isdev() or member.islnk() or member.issym():
            continue

        try:
            # Resolve the member's path to an absolute path.
            # This evaluates any '..' path components.
            member_path = (dest / member.name).resolve()
        except FileNotFoundError:
            # This can happen if the tarball contains a symlink that points
            # to a file that does not exist. We can ignore it.
            continue

        # Check if the resolved path is within the destination directory.
        if not member_path.is_relative_to(dest_resolved):
            # This indicates a path traversal attempt.
            continue

        members.append(member)

    return members


def extractall(source: Path, dest: Path) -> None:
    """
    Extracts a tar archive with path traversal protection.
    """
    with tarfile.open(source, "r") as tar:
        # The 'data' filter, new in Python 3.12, provides this protection.
        if hasattr(tarfile, "data_filter"):
            tar.extractall(dest, filter="data")
        else:
            # For older Python versions (like the vulnerable 3.10 and 3.11),
            # we manually filter for safe members before extraction.
            safe_members = _get_safe_members(tar, dest)
            tar.extractall(dest, members=safe_members)