Implement PEP 706 – Filter for tarfile.extractall

[encukou]

This issue tracks implementation of PEP 706 – Filter for tarfile.extractall

• Fix WASI tests (or at least understand and document the symlink behavior)

Linked PRs

• gh-102950: Implement PEP 706 – Filter for tarfile.extractall #102953
• [3.11] gh-102950: Implement PEP 706 – Filter for tarfile.extractall (GH-102953) #103832
• [3.10] gh-102950: Implement PEP 706 – Filter for tarfile.extractall (GH-102953) #104128
• [3.10] gh-102950: Implement PEP 706 – Filter for tarfile.extractall (GH-102953) #104327
• [3.9] gh-102950: Implement PEP 706 – Filter for tarfile.extractall (GH-102953) #104382
• [3.8] gh-102950: Implement PEP 706 – Filter for tarfile.extractall (GH-102953) #104548
• [3.7] gh-102950: Implement PEP 706 – Filter for tarfile.extractall (GH-102953)  #104583

Unofficial backport

• 3.6 backport for tarfile filters encukou/cpython#26

[mcepl]

And I really think #73974 (CVE-2007-4559) should be mentioned somewhere in this PR.

[encukou]

Well, the PR was open for a month, but now it's closed. Feel free to suggest an update to the docs.
Note that Python 3.12 doesn't “fix” CVE-2007-4559 (depending on how you define “fix”).