Guard dataset tar extraction against path traversal (TarSlip)

[ousamabenyounes]

Fixes #9517

Problem

torchvision/datasets/utils.py::_extract_tar called tar.extractall(to_path) with no member validation (TarSlip / CVE-class path traversal). A crafted archive member named ../evil — or a symlink/hardlink pointing outside — writes outside the extraction root. download_and_extract_archive feeds a caller-provided URL straight into this sink, so a malicious dataset mirror can drop files anywhere the process can write.

Fix (root cause, tar-scoped)

• Extract via CPython PEP 706 data filter (extractall(to_path, filter="data")), which rejects traversal, absolute paths, and escaping links. It is the default on 3.14 and available since 3.12 (backported to 3.10.12+/3.11.4+).
• For interpreters predating the backport, a manual _reject_escaping_tar_members guard validates every member (and link target) against the realpath'd root before extraction writes anything.
• _extract_zip is left untouched: zipfile.extractall already strips .. and absolute components (verified).

Test verification (RED → GREEN)

New parametrized test test_extract_tar_rejects_path_traversal (Python 3.12.13, CPU):

# RED (unmodified base):
Failed: DID NOT RAISE any of (TarError, RuntimeError)
FAILED test_extract_tar_rejects_path_traversal[../escaped.txt]
FAILED test_extract_tar_rejects_path_traversal[../../escaped.txt]
# GREEN (with fix): full test_datasets_utils.py
57 passed, 1 warning

(Independently reconfirmed the mechanism on this machine: extractall(filter="data") raises OutsideDestinationError on a ../escaped.txt member while a pre-3.12-default extractall writes it outside the root.)

Disclosure (per AI_POLICY.md): this change was prepared with AI assistance and was reviewed, tested, and is submitted by me. Happy to iterate on any feedback.

[pytorch-bot]

🔗 Helpful Links

🧪 See artifacts and rendered test results at hud.pytorch.org/pr/pytorch/vision/9590

• 📄 Preview Python docs built from this PR

Note: Links to docs will display an error until the docs builds have been completed.

This comment was automatically generated by Dr. CI and updates every 15 minutes.