gh-156026: document tar filter link targets

[Amandot]

Summary

Document the behavior of the tar extraction filter when handling
symbolic-link targets.

tar_filter protects against archive member paths escaping the extraction
destination, but it does not check TarInfo.linkname. As a result, symbolic
links with absolute targets or relative targets outside the destination are
not rejected by this filter.

This change clarifies that behavior in the tar filter documentation and
the tar_filter section.

The stricter data_filter behavior is also documented, including the
exceptions raised for unsafe link targets.

No extraction behavior has been changed.

Testing

• git diff --check
• Full documentation checks were attempted, but the documentation environment
  required dependency installation and the check was not completed.

• Issue: Doc/library/tarfile.rst: document that the 'tar' extraction filter does not bound link targets #156026

[python-cla-bot]

All commit authors signed the Contributor License Agreement.

[read-the-docs-community]

Documentation build overview

📚 cpython-previews | 🛠️ Build #34139088 | 📁 Comparing bdb2a0e against main (20e6c2f)

  🔍 Preview build  

1 file changed

± library/tarfile.html