main: filter out malicious files when extracting tar archives

pyproject.toml

@@ -87,6 +87,7 @@ source = [
 exclude_lines = [
   '\#\s*pragma: no cover',
   '^\s*raise NotImplementedError\b',
+  "if typing.TYPE_CHECKING:",
 ]
 
 [tool.coverage.paths]

src/build/__main__.py

@@ -9,7 +9,6 @@
 import shutil
 import subprocess
 import sys
-import tarfile
 import tempfile
 import textwrap
 import traceback
@@ -230,6 +229,8 @@ def build_package_via_sdist(
     :param isolation: Isolate the build in a separate environment
     :param skip_dependency_check: Do not perform the dependency check
     """
+    from ._util import TarFile
+
     if 'sdist' in distributions:
         raise ValueError('Only binary distributions are allowed but sdist was specified')
 
@@ -240,7 +241,7 @@ def build_package_via_sdist(
     built: list[str] = []
     if distributions:
         # extract sdist
-        with tarfile.open(sdist) as t:
+        with TarFile.open(sdist) as t:
             t.extractall(sdist_out)
             try:
                 _ProjectBuilder.log(f'Building {_natural_language_list(distributions)} from sdist')

src/build/_util.py

@@ -2,6 +2,8 @@
 
 import re
 import sys
+import tarfile
+import typing
 
 from collections.abc import Iterator, Set
 
@@ -65,3 +67,18 @@
 
 def parse_wheel_filename(filename: str) -> re.Match[str] | None:
     return _WHEEL_FILENAME_REGEX.match(filename)
+
+
+if typing.TYPE_CHECKING:
+    TarFile = tarfile.TarFile
+
+else:
+    # Per https://peps.python.org/pep-0706/, the "data" filter will become
+    # the default in Python 3.14.
+    if sys.version_info < (3, 14) and hasattr(tarfile, 'data_filter'):
+
+        class TarFile(tarfile.TarFile):
+            extraction_filter = staticmethod(tarfile.data_filter)
+
+    else:
+        TarFile = tarfile.TarFile