임의 파일 쓰기 아카이브 추출을 통한 공격 (Tar Slip)

# Tar extraction using the runtime default filter
import tarfile

def unsafe_extract(tar_file_path, extract_path):
    with tarfile.open(tar_file_path) as tar:
        tar.extractall(path=extract_path)

# Safe tar extraction
import tarfile
import os
import shutil
from pathlib import Path

def safe_extract(tar_file_path, extract_path):
    destination = Path(extract_path)
    # 기존 파일이나 링크가 없는 새 전용 디렉터리에서만 추출
    destination.mkdir(mode=0o700, exist_ok=False)
    destination = destination.resolve()

    with tarfile.open(tar_file_path) as tar:
        if hasattr(tarfile, "data_filter"):
            # 추출 필터를 지원하는 런타임의 제한적 데이터 추출 정책
            tar.extractall(path=destination, filter="data")
            return

        # 레거시 fallback: 링크와 특수 파일을 모두 거부하고 경계를 검증
        for member in tar.getmembers():
            if member.issym() or member.islnk():
                raise ValueError("Tar links are not allowed")
            if not (member.isfile() or member.isdir()):
                raise ValueError("Unsupported tar entry type")

            target = (destination / member.name).resolve()
            try:
                target.relative_to(destination)
            except ValueError as error:
                raise ValueError("Tar entry escapes extraction directory") from error

            if member.isdir():
                target.mkdir(parents=True, exist_ok=True, mode=0o700)
                continue

            target.parent.mkdir(parents=True, exist_ok=True, mode=0o700)
            source = tar.extractfile(member)
            if source is None:
                raise ValueError("Tar entry has no file data")
            fd = os.open(target, os.O_WRONLY | os.O_CREAT | os.O_EXCL, 0o600)
            with source, os.fdopen(fd, "wb") as output:
                shutil.copyfileobj(source, output)