Sample TAR+GZIP file (valid.tar)

Handle it in code

Each snippet below was run against this exact file with Python 3.14.4 and Node 24.15.0 when this page was built, and the output shown is what it printed.

Python

Extract with the 'data' filter (Python 3.12+, and backported to security releases of 3.8 to 3.11). It refuses absolute paths, '..', links that point outside the folder and device files. Python 3.14 makes it the default, but passing it keeps older versions safe.

import tarfile

with tarfile.open("valid.tar.gz") as tar:  # detects gzip, bzip2 and xz by itself
    try:
        tar.extractall("out", filter="data")
        print("extracted:", ", ".join(m.name for m in tar.getmembers()))
    except tarfile.FilterError as e:
        print("blocked:", e)

Run against this file, it prints: extracted: readme.txt, logs/app.log