Make extract() more robust

  * handle filenames with spaces
  * protect against tarbombs