Repository: pypa/pip
File: src/pip/_internal/utils/unpacking.py (Python)

Code before:
                    )
                if member.isfile() and orig_mode & 0o111:
                    member.mode = default_mode_plus_executable
                else:
                    # See PEP 706 note above.
                    # The PEP changed this from `int` to `Optional[int]`,
                    # where None means "use the default". Mypy doesn't
                    # know this yet.
                    member.mode = None  # type: ignore [assignment]
                return member

            tar.extractall(location, filter=pip_filter)

    finally:
        tar.close()


def _untar_without_filter(
    filename: str,
    location: str,
    tar: tarfile.TarFile,
    leading: bool,
) -> None:
    """Fallback for Python without tarfile.data_filter"""

    def _check_link_target(tar: tarfile.TarFile, tarinfo: tarfile.TarInfo) -> None:
        linkname = "/".join(
            filter(None, (os.path.dirname(tarinfo.name), tarinfo.linkname))
        )

        linkname = os.path.normpath(linkname)

        try:
            tar.getmember(linkname)
        except KeyError:
            if "\\" in linkname or "/" in linkname:
                if "\\" in linkname:
                    linkname = linkname.replace("\\", "/")
                else:
                    linkname = linkname.replace("/", "\\")
                try:
                    tar.getmember(linkname)
                except KeyError:
                    raise KeyError(linkname)
            else:
                raise KeyError(linkname)

    for member in tar.getmembers():
        fn = member.name
        if leading:
            fn = split_leading_dir(fn)[1]

Review comment (refactor):
Please move this function outside the `_untar_without_filter`, there is no reason to nest the definition, IMO it makes it harder to read.

Also, either provide a docstring explaining what this function does or provide a more expressive name, specifically what are we checking about link target?

Code after:
                    )
                if member.isfile() and orig_mode & 0o111:
                    member.mode = default_mode_plus_executable
                else:
                    # See PEP 706 note above.
                    # The PEP changed this from `int` to `Optional[int]`,
                    # where None means "use the default". Mypy doesn't
                    # know this yet.
                    member.mode = None  # type: ignore [assignment]
                return member

            tar.extractall(location, filter=pip_filter)

    finally:
        tar.close()


def is_symlink_target_in_tar(tar: tarfile.TarFile, tarinfo: tarfile.TarInfo) -> bool:
    """Check if the file pointed to by the symbolic link is in the tar archive"""
    linkname = os.path.join(os.path.dirname(tarinfo.name), tarinfo.linkname)

    linkname = os.path.normpath(linkname)
    linkname = linkname.replace("\\", "/")

    try:
        tar.getmember(linkname)
        return True
    except KeyError:
        return False


def _untar_without_filter(
    filename: str,
    location: str,
    tar: tarfile.TarFile,
    leading: bool,
) -> None:
    """Fallback for Python without tarfile.data_filter"""
    # NOTE: This function can be removed once pip requires CPython ≥ 3.12.​
    # PEP 706 added tarfile.data_filter, made tarfile extraction operations more secure.
    # This feature is fully supported from CPython 3.12 onward.
    for member in tar.getmembers():
        fn = member.name
        if leading:
            fn = split_leading_dir(fn)[1]
        path = os.path.join(location, fn)
        if not is_within_directory(location, path):
            message = (
                "The tar file ({}) has a file ({}) trying to install "
                "outside target directory ({})"
            )