---
id: tarsafe
version: "0.0.5"
license: MIT License
license_treatment: permissive
maintenance: active
---

# tarsafe — A safe subclass of the TarFile class for interacting with tar files. Can be used as a direct drop-in replacement for safe usage of extractall()

License: permissive · Maintenance: active · Downloads: 396.8K/mo

## What it is and what it does

Tarsafe is a security-focused wrapper around Python's standard tarfile module designed to address a long-standing vulnerability in the extractall() method. The standard library's tarfile.extractall() can be exploited to write files outside the intended extraction directory through crafted tar archives. Tarsafe provides a TarSafe class that acts as a drop-in replacement, sanitizing extraction paths to prevent these attacks.

The package requires Python 3.6 or later and has no external runtime dependencies, making it lightweight to integrate into existing projects. It maintains the same API as the standard tarfile module, so switching from tarfile.TarFile to TarSafe.open() typically requires only a single line change. The project is actively maintained with recent updates.

Use it for:

- Safely extract user-uploaded tar archives in web applications without risk of directory traversal attacks.
- Process untrusted tar files in automated build or deployment pipelines where path validation is critical.
- Replace tarfile in existing codebases to harden against tar-based exploits with minimal refactoring.
- Handle tar archives in security-sensitive contexts such as package managers or container image extraction.

## Worth the install?

AI-flagged interpretation of the facts above — verify before relying.

Tarsafe wraps Python's tarfile module to prevent path traversal attacks during tar extraction, providing a drop-in replacement for the standard library's extractall() method.

Yes, if you extract tar files from untrusted sources or need to harden an existing tarfile-based workflow. The zero-dependency design and drop-in API make adoption straightforward. Verify that it addresses your specific threat model before relying on it for critical security boundaries.

## Install

pip install tarsafe
uv add tarsafe
poetry add tarsafe

## Installing tarsafe

Before you install: Low friction—pure Python wheel with no runtime dependencies. Maintenance is active with a recent commit on 2026-08-13, though the latest release is from 2023-03-21.

License in practice: MIT License permits free use, modification, and distribution with minimal restrictions, suitable for both open-source and commercial projects.

Quickstart:

pip install tarsafe

from tarsafe import TarSafe

with TarSafe.open("example.tar", "r") as tar:
    tar.extractall()

Verify before relying:

- What specific path traversal attack vectors does extractall() address beyond the 6 year old security bug mentioned?
- Does the package handle symlink attacks or other tar-specific security issues beyond directory traversal?

## Package facts

- License: MIT License (permissive)
- Python support: supports_current
- Install friction: low
- Maintenance: active
- Downloads: 396.8K/month (top 15,000 on PyPI)
- Known vulnerabilities: none known

## Tags

tar extraction security, safe tarfile extraction, tar archive vulnerability, tarfile security wrapper, path traversal prevention, path-traversal-defense, archive-security

[View on SkillFed](https://skillfed.io/packages/tarsafe) · [View on PyPI](https://pypi.org/project/tarsafe/)