Patched code sample

import tarfile
import os

def safe_extract_tar_archive(tar_file_path, extraction_dir):
    """
    Safely extracts a .tar archive by individually checking each member
    to prevent path traversal and symlink attacks as described in CVE-2026-64824.
    """
    # Resolve the destination directory to an absolute path to prevent ambiguity.
    real_extraction_dir = os.path.realpath(extraction_dir)

    with tarfile.open(tar_file_path) as tar:
        for member in tar.getmembers():
            # Build the full, intended destination path for the current member.
            destination_path = os.path.join(real_extraction_dir, member.name)
            
            # Resolve the real path, which will handle '..' components.
            real_destination_path = os.path.realpath(destination_path)

            # 1. The primary path traversal check.
            # Ensure the resolved destination path is still inside the extraction directory.
            # This blocks member names like "../../../etc/passwd" or "/etc/passwd".
            if not real_destination_path.startswith(real_extraction_dir):
                raise PermissionError(
                    f"Path traversal attempt blocked for member '{member.name}'."
                )

            # 2. Specific fix for the symlink vulnerability (CVE-2026-64824).
            # If the member is a symlink, we must also validate its target.
            if member.issym():
                # Build the full path of the symlink's target.
                link_target_path = os.path.join(os.path.dirname(destination_path), member.linkname)
                
                # Resolve the real path of the link's target.
                real_link_target_path = os.path.realpath(link_target_path)

                # Ensure the symlink's target does not point outside the extraction directory.
                # This prevents a symlink from being created that points to an absolute
                # path like '/home/user/.ssh/authorized_keys'.
                if not real_link_target_path.startswith(real_extraction_dir):
                    raise PermissionError(
                        f"Blocked symlink '{member.name}' pointing outside extraction dir "
                        f"to '{member.linkname}'."
                    )
            
            # If all security checks pass, extract the member.
            tar.extract(member, path=extraction_dir)