TarFile.extract raises DeprecationWarning since Python 3.12

[danielhollas]

Issue

Calls to stdlib tar.TarFile.extract (or tar.TarFile.extractall) started raising the following DeprecationWarning since Python 3.12

/opt/hostedtoolcache/Python/3.12.7/x64/lib/python3.12/site-packages/aiida/storage/sqlite_zip/migrations/legacy_to_main.py:81: DeprecationWarning: Python 3.14 will, by default, filter extracted tar archives and reject files or modify their metadata. Use the filter argument to control this behavior.

In general, extracting untrusted tarfiles is an unsafe operation (since the tarfile can contain relative paths (e.g. ../malicious_file.txt) or absolute paths to known locations. See PEP 706, which added the filter argument to extract methods in Python 3.12. When this argument is omitted a DeprecationWarning is raised.

Solution

Documentation on extraction filters

See this section of the PEP how to deal with this in a backwards compatible manner
https://peps.python.org/pep-0706/#backporting-forward-compatibility

Open questions

Which filter should we use by default? Probably data, which is recommended and will be default since 3.14.

Your environment

• Python version: >=3.12