path traversal bug related to the use of the tarfile module

[d1b]

pip/util.py is vulnerable to path traversal when un-taring a tarfile in the untar_file method.
Provided that a malicious tar file is comprised of two entries with different starting paths (has_leading_dir returns false on line 485) the code in untar_file takes the filename provided from the call to tar.getmembers(line 489) and copies over the zip file contents out on line 525 (shutil.copyfileobj(fp, destfp) ).

[dstufft]

Duplicate of #3907.

[d1b]

@dstufft shouldn't the other issue be a duplicate of this one given that this issue is older ? (I don't mind)

[dstufft]

@d1b Yes generally, though I choose that one over this one because it worked as a stand in for both .zip and .tar while your two had one each.