title: Safely extract zip or tar using Python
body: <p>I'm trying to extract user-submitted zip and tar files to a directory. The documentation for zipfile's <a href="http://docs.python.org/library/zipfile.html#zipfile.ZipFile.extractall">extractall</a> method (similarly with tarfile's <a href="http://docs.python.org/library/tarfile.html#tarfile.TarFile.extractall">extractall</a>) states that it's possible for paths to be absolute or contain <code>..</code> paths that go outside the destination path. Instead, I could use <code>extract</code> myself, like this:</p>
  
  <pre><code>some_path = '/destination/path'
  some_zip = '/some/file.zip'
  zipf = zipfile.ZipFile(some_zip, mode='r')
  for subfile in zipf.namelist():
      zipf.extract(subfile, some_path)
  </code></pre>
  
  <p>Is this safe? Is it possible for a file in the archive to wind up outside of <code>some_path</code> in this case? If so, what way can I ensure that files will never wind up outside the destination directory?</p>