python: Add extract filter for tarfile.extractall (#3340)

python/grass/temporal/stds_import.py

@@ -274,7 +274,18 @@ def import_stds(
         gscript.fatal(_("Unable to find projection file <%s>") % proj_file_name)
 
     msgr.message(_("Extracting data..."))
-    tar.extractall(path=directory)
+    # Extraction filters were added in Python 3.12,
+    # and backported to 3.8.17, 3.9.17, 3.10.12, and 3.11.4
+    # See https://docs.python.org/3.12/library/tarfile.html#tarfile-extraction-filter
+    # and https://peps.python.org/pep-0706/
+    # In Python 3.12, using `filter=None` triggers a DepreciationWarning,
+    # and in Python 3.14, `filter='data'` will be the default
+    if hasattr(tarfile, "data_filter"):
+        tar.extractall(path=directory, filter="data")
+    else:
+        # Remove this when no longer needed
+        gscript.warning(_("Extracting may be unsafe; consider updating Python"))
+        tar.extractall(path=directory)
     tar.close()
 
     # We use a new list file name for map registration

python/grass/utils/download.py

@@ -52,7 +52,21 @@ def extract_tar(name, directory, tmpdir):
         tar = tarfile.open(name)
         extract_dir = os.path.join(tmpdir, "extract_dir")
         os.mkdir(extract_dir)
-        tar.extractall(path=extract_dir)
+
+        # Extraction filters were added in Python 3.12,
+        # and backported to 3.8.17, 3.9.17, 3.10.12, and 3.11.4
+        # See
+        # https://docs.python.org/3.12/library/tarfile.html#tarfile-extraction-filter
+        # and https://peps.python.org/pep-0706/
+        # In Python 3.12, using `filter=None` triggers a DepreciationWarning,
+        # and in Python 3.14, `filter='data'` will be the default
+        if hasattr(tarfile, "data_filter"):
+            tar.extractall(path=extract_dir, filter="data")
+        else:
+            # Remove this when no longer needed
+            debug(_("Extracting may be unsafe; consider updating Python"))
+            tar.extractall(path=extract_dir)
+
         files = os.listdir(extract_dir)
         _move_extracted_files(
             extract_dir=extract_dir, target_dir=directory, files=files

scripts/g.extension/g.extension.py

@@ -1839,18 +1839,34 @@ def extract_tar(name, directory, tmpdir):
         " tmpdir={tmpdir})".format(name=name, directory=directory, tmpdir=tmpdir),
         3,
     )
-    try:
-        import tarfile  # we don't need it anywhere else
+    import tarfile
 
+    try:
         tar = tarfile.open(name)
         extract_dir = os.path.join(tmpdir, "extract_dir")
         os.mkdir(extract_dir)
-        tar.extractall(path=extract_dir)
+
+        # Extraction filters were added in Python 3.12,
+        # and backported to 3.8.17, 3.9.17, 3.10.12, and 3.11.4
+        # See
+        # https://docs.python.org/3.12/library/tarfile.html#tarfile-extraction-filter
+        # and https://peps.python.org/pep-0706/
+        # In Python 3.12, using `filter=None` triggers a DepreciationWarning,
+        # and in Python 3.14, `filter='data'` will be the default
+        if hasattr(tarfile, "data_filter"):
+            tar.extractall(path=extract_dir, filter="data")
+        else:
+            # Remove this when no longer needed
+            gs.warning(_("Extracting may be unsafe; consider updating Python"))
+            tar.extractall(path=extract_dir)
+
         files = os.listdir(extract_dir)
         move_extracted_files(extract_dir=extract_dir, target_dir=directory, files=files)
     except tarfile.TarError as error:
         gs.fatal(_("Archive file is unreadable: {0}").format(error))
 
+    del tarfile  # we don't need it anywhere else
+
 
 extract_tar.supported_formats = ["tar.gz", "gz", "bz2", "tar", "gzip", "targz"]
 

scripts/r.unpack/r.unpack.py

@@ -110,7 +110,18 @@ def main():
             )
 
     # extract data
-    tar.extractall()
+    # Extraction filters were added in Python 3.12,
+    # and backported to 3.8.17, 3.9.17, 3.10.12, and 3.11.4
+    # See https://docs.python.org/3.12/library/tarfile.html#tarfile-extraction-filter
+    # and https://peps.python.org/pep-0706/
+    # In Python 3.12, using `filter=None` triggers a DepreciationWarning,
+    # and in Python 3.14, `filter='data'` will be the default
+    if hasattr(tarfile, "data_filter"):
+        tar.extractall(filter="data")
+    else:
+        # Remove this when no longer needed
+        grass.warning(_("Extracting may be unsafe; consider updating Python"))
+        tar.extractall()
     tar.close()
     os.chdir(data_names[0])
 

scripts/v.unpack/v.unpack.py

@@ -120,7 +120,18 @@ def main():
         shutil.rmtree(new_dir, True)
 
     # extract data
-    tar.extractall()
+    # Extraction filters were added in Python 3.12,
+    # and backported to 3.8.17, 3.9.17, 3.10.12, and 3.11.4
+    # See https://docs.python.org/3.12/library/tarfile.html#tarfile-extraction-filter
+    # and https://peps.python.org/pep-0706/
+    # In Python 3.12, using `filter=None` triggers a DepreciationWarning,
+    # and in Python 3.14, `filter='data'` will be the default
+    if hasattr(tarfile, "data_filter"):
+        tar.extractall(filter="data")
+    else:
+        # Remove this when no longer needed
+        grass.warning(_("Extracting may be unsafe; consider updating Python"))
+        tar.extractall()
     tar.close()
     if os.path.exists(os.path.join(data_name, "coor")):
         pass