tarsafe

library0.0.5pypypi✓ verified 85d ago

Tarsafe is a Python library that provides a safe subclass of the standard library's `tarfile.TarFile` class, primarily addressing a known security vulnerability in the `extractall()` method. It serves as a direct drop-in replacement to safely interact with tar archives. The current version is 0.0.5, and its release cadence appears sporadic, reflecting its nature as a security-focused enhancement.

auth-security serialization

pip install tarsafe

github ↗package ↗

INSTALL

IMPORT

SIG · TARSAFE

tarsafe

auth-securitypythonv0.0.5

Install

1.6s avg

Import

24ms

Disk

16MB

Pass rate

10/ 10

Env Coverage10 / 10

glibc

3.9–3.13

musl

3.9–3.13

Install & Compatibility

Where this runs

tested against v0.0.5 · pip install

no network on importno background threads

Install × environment matrix

Each cell = how many times install + import succeeded across repeated harness runs. Partial = flaky.
glibc = Debian/Ubuntu slim · musl = Alpine Linux

musl

py 3.10–3.920 runs

installs and imports cleanly · install 0.0s · import 0.026s · 17.8MB

glibc

py 3.10–3.920 runs

installs and imports cleanly · install 1.6s · import 0.023s · 18MB

16MB installed

● package 16MB

Code

Verified usage

Verified import paths — ran on the pinned version, not inferred.

TarSafe

✓ from tarsafe import TarSafe

Initialize a `TarSafe` object with your tar file and use `extractall()` as a direct, secure replacement for the standard library's method.

from tarsafe import TarSafe # Assuming 'example.tar' exists in the current directory tar = TarSafe.open('example.tar', 'r') # This method is now safe against directory traversal vulnerabilities tar.extractall() tar.close()

Debug

Known issues

breakingThe standard library's `tarfile.extractall()` method (prior to Python 3.11 with `filter` argument) is vulnerable to directory traversal attacks, allowing malicious tar files to write files outside the intended extraction directory. Tarsafe was created to mitigate this vulnerability by default.

fix

Replace `tarfile.open` with `tarsafe.TarSafe.open` and ensure `extractall()` is called on the `TarSafe` object. Python 3.11+ users can also use `tarfile.open(..., filter='data')`.

affects: Python's `tarfile` module, especially versions prior to 3.11 without the `filter='data'` argument.

gotchaTarsafe's `extractall()` method actively prevents directory traversal. While this is its intended security feature, it means that archives designed to exploit this vulnerability will have their malicious components blocked, potentially leading to 'missing' files if you expected the vulnerable behavior.

fix

Ensure your tar archives are correctly formed and do not rely on implicit directory traversal for file placement. Review the contents of untrusted archives before extraction.

affects: All versions of tarsafe

Errors

Common errors & fixes

Arbitrary file write vulnerability when extracting tar files

Using the standard library's `tarfile.extractall()` method without proper sanitization or the `filter` argument (Python 3.11+).

fix

Replace `from tarfile import open` with `from tarsafe import TarSafe as open` or explicitly use `tarsafe.TarSafe.open()` for secure extraction.

ModuleNotFoundError: No module named 'tarsafe'

The 'tarsafe' library has not been installed in your Python environment.

fix

Run `pip install tarsafe` to install the library.

Tar extraction fails with unexpected file path errors for trusted archives after switching to tarsafe.

While `tarsafe` prevents malicious extractions, it strictly enforces path safety. If your 'trusted' archives inadvertently contain paths that could be interpreted as directory traversal attempts (e.g., `../`, absolute paths), `tarsafe` will block them.

fix

Inspect the paths within your tar archive. Ensure all paths are relative to the archive's root and do not contain `..` or absolute path indicators. Re-create archives with clean paths if necessary.

Upgrade

Version history

0.0.5latest on PyPI · released Mar 21, 2023

Audit

Dependencies

No dependency data recorded yet.

Agent activity

21 hits · last 30 days

node

OpenAI (training)

Resources

githubhttps://github.com/beatsbears/tarsafe ↗

packagehttps://pypi.org/project/tarsafe/ ↗