Python 3.12+tarfileexception

tarfile.OutsideDestinationError

exceptions

The extraction filter exception for a member that would land outside the destination folder (path traversal via '..').

Syntax

except tarfile.OutsideDestinationError:

This blocks a classic attack: an archive with the name '../../.bashrc', extracted without a filter, overwrites a file outside the folder. The 'data' and 'tar' filters compute the final path and refuse; before Python 3.14 there was no protection without filter. The message contains the absolute destination path, so log e.tarinfo.name instead.

Examples

import tarfile
m = tarfile.TarInfo('../../.bashrc')
try:
    tarfile.tar_filter(m, 'out')
except tarfile.OutsideDestinationError as e:
    print(type(e).__name__, e.tarinfo.name)  # → OutsideDestinationError ../../.bashrc

See also

Common errors

Open in the full glossarydocs.python.orgReport an inaccuracy