{"categories":[{"label":"Security","url":"https://skillfed.io/packages/category/security/2"}],"enrichment":{"capability":"Tarsafe wraps Python's tarfile module to prevent path traversal attacks during tar extraction, providing a drop-in replacement for the standard library's extractall() method.","skillfed_tags":["path-traversal-defense","archive-security"],"use_cases":["Safely extract user-uploaded tar archives in web applications without risk of directory traversal attacks.","Process untrusted tar files in automated build or deployment pipelines where path validation is critical.","Replace tarfile in existing codebases to harden against tar-based exploits with minimal refactoring.","Handle tar archives in security-sensitive contexts such as package managers or container image extraction."],"what_it_does":"Tarsafe is a security-focused wrapper around Python's standard tarfile module designed to address a long-standing vulnerability in the extractall() method. The standard library's tarfile.extractall() can be exploited to write files outside the intended extraction directory through crafted tar archives. Tarsafe provides a TarSafe class that acts as a drop-in replacement, sanitizing extraction paths to prevent these attacks.\n\nThe package requires Python 3.6 or later and has no external runtime dependencies, making it lightweight to integrate into existing projects. It maintains the same API as the standard tarfile module, so switching from tarfile.TarFile to TarSafe.open() typically requires only a single line change. The project is actively maintained with recent updates.","worth_installing":"Yes, if you extract tar files from untrusted sources or need to harden an existing tarfile-based workflow. The zero-dependency design and drop-in API make adoption straightforward. Verify that it addresses your specific threat model before relying on it for critical security boundaries."},"id":"tarsafe","links":{"html":"https://skillfed.io/packages/tarsafe","md":"https://skillfed.io/packages/tarsafe.md","pypi":"https://pypi.org/project/tarsafe/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2023-03-21","license_spdx":null,"license_treatment":"permissive","name":"tarsafe","python_support":"supports_current","summary":"A safe subclass of the TarFile class for interacting with tar files. Can be used as a direct drop-in replacement for safe usage of extractall()"},"popularity":{"monthly_downloads":396782,"position":6969,"tier":"top_15000"},"security":{"n_vulnerabilities":0},"version":"0.0.5"}