Check TAR paths before extraction
A TAR member carries a name, type, mode and optional link target. PAX and GNU extensions can replace names found in ordinary headers. This auditor applies supported overrides before checking absolute paths, parent traversal, Windows drive and UNC paths, control characters, platform-dependent components, duplicate normalized destinations, and case or Unicode collisions. A pathname is never silently repaired into an approved entry.
Symlink pivots, hardlinks and special files
A symlink used as a later member’s parent can redirect writes. The auditor flags all nondirectory parent relationships regardless of order, checks root-relative hardlinks and parent-relative symlinks, and traces supplied link chains and cycles. Device nodes, FIFOs, privileged mode bits and world-writable permissions receive separate findings. Header UID:GID is evidence rather than a recommendation to restore ownership.
Supported formats and limits
Supports v7, POSIX ustar, GNU long name/link records, POSIX PAX length-prefixed UTF-8 records and old GNU sparse extension framing. GNU sparse and SCHILY sparse keys are inventoried. Sparse content is never expanded. Invalid checksums or unreadable boundaries stop the scan; truncation, missing end blocks and nonzero trailing data block the allowlist. Global PAX path, linkpath or size overrides also block the allowlist because extractor interpretation varies. Compressed formats other than gzip, invalid UTF-8 names, negative timestamps, multivolume extensions and concatenated archives require another local utility.
Using the conservative extraction-review manifest
The JSON manifest identifies ordinary files and directories by member number and expanded header offset, with an input SHA-256 for archive identity. It excludes every member with a finding and blocks all entries when archive structure is invalid. Review it for a fresh empty destination and use a maintained local extractor with strict path and link controls. Suggested modes are 0644 for files and 0755 for directories; do not restore archive ownership, stored permissions, ACLs or extended attributes. The manifest is a review artifact, not an extractor command or a sanitized archive.
This is an analysis aid. It does not authenticate file contents, scan malware, model an existing filesystem, prove complete vendor-extension semantics, or prevent extractor bugs and filesystem races. Link paths containing parent components can vary with intermediate symlinks. Verify the archive and intended members in an isolated environment with the target version of GNU tar or libarchive before extraction.
Frequently asked questions
Does this extract or upload my archive?
No. A cancellable browser worker reads the archive locally. It never writes members to disk, follows host links or uploads file content. Downloads contain reports and a review manifest, not extracted files.
Which TAR formats are supported?
Plain v7, POSIX ustar, GNU long names and links, POSIX PAX overrides and old GNU sparse framing are supported with UTF-8 names and nonnegative safe-integer numeric fields. Gzip is expanded locally. Sparse metadata is inventoried, not reconstructed or fully validated. XZ, bzip2, Zstandard, multivolume and concatenated TAR archives are outside this bounded subset.
Is the safe-extraction manifest a safety guarantee?
No. It is a conservative allowlist for review in a fresh empty destination. Only ordinary files and directories with no findings qualify. Links, sparse files, duplicate paths, special types and review findings are excluded. Invalid archive structure blocks the entire allowlist. File contents, existing filesystem state, extractor bugs and malware remain unchecked.
Why can a relative symlink be risky?
A link may point outside the extraction root, cycle through other links, or become the parent of a later member. The auditor checks supplied member relationships; an existing destination filesystem and filesystem races require separate local verification.
Format and security references
See the GNU tar manual’s basic TAR format, sparse format internals, and reliability and security guidance.