tarsafe

What it is and what it does

Tarsafe is a security-focused wrapper around Python's standard tarfile module designed to address a long-standing vulnerability in the extractall() method. The standard library's tarfile.extractall() can be exploited to write files outside the intended extraction directory through crafted tar archives. Tarsafe provides a TarSafe class that acts as a drop-in replacement, sanitizing extraction paths to prevent these attacks.

The package requires Python 3.6 or later and has no external runtime dependencies, making it lightweight to integrate into existing projects. It maintains the same API as the standard tarfile module, so switching from tarfile.TarFile to TarSafe.open() typically requires only a single line change. The project is actively maintained with recent updates.

Use it for:

• Safely extract user-uploaded tar archives in web applications without risk of directory traversal attacks.
• Process untrusted tar files in automated build or deployment pipelines where path validation is critical.
• Replace tarfile in existing codebases to harden against tar-based exploits with minimal refactoring.
• Handle tar archives in security-sensitive contexts such as package managers or container image extraction.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

Tarsafe wraps Python's tarfile module to prevent path traversal attacks during tar extraction, providing a drop-in replacement for the standard library's extractall() method.

Yes, if you extract tar files from untrusted sources or need to harden an existing tarfile-based workflow. The zero-dependency design and drop-in API make adoption straightforward. Verify that it addresses your specific threat model before relying on it for critical security boundaries.

Install

tarsafe on PyPI

pip install tarsafe

uv add tarsafe

poetry add tarsafe

Installing tarsafe

Before you install

Low friction—pure Python wheel with no runtime dependencies. Maintenance is active with a recent commit on 2026-08-13, though the latest release is from 2023-03-21.

License in practice

MIT License permits free use, modification, and distribution with minimal restrictions, suitable for both open-source and commercial projects.

Quickstart

pip install tarsafe

from tarsafe import TarSafe

with TarSafe.open("example.tar", "r") as tar:
    tar.extractall()

Verify before relying

• What specific path traversal attack vectors does extractall() address beyond the 6 year old security bug mentioned?
• Does the package handle symlink attacks or other tar-specific security issues beyond directory traversal?

Package facts

Evidence: tarsafe-0.0.5-py3-none-any.whl

Tags

More Security packages