Library API Placeholder Break

safer_name_suffix() runs before strip_name_components, so path traversal introduced by stripping is never re-validated. | GNU tar (release_1_29) allows writing files outside the extraction directory when using --strip-components. — when using --strip-components. Outcome: the file appears at /tmp/pwned rather than inside the extraction directory. | in decode_xform(). Tension: not just before.