Extract untrusted archives

import tarfile, io
with tarfile.open('upload.tar', 'w') as t:
    for name, data in [('readme.txt', b'hello\n'), ('../../home/user/.bashrc', b'echo pwned\n')]:
        i = tarfile.TarInfo(name); i.size = len(data); t.addfile(i, io.BytesIO(data))

using RecursiveAI.OneArchive;
using RecursiveAI.OneCompress;
 
// upload.tar came from a user: one good entry, and one whose name climbs out of the target.
using (var archive = Archive.Open("upload.tar"))
    foreach (var e in archive.Entries) Console.WriteLine($"entry: {e.Name}");
 
try
{
    Archive.Extract("upload.tar", "out");
}
catch (ArchiveSafetyException e)
{
    Console.WriteLine($"refused: rule {e.Rule}, entry {e.EntryName}");
}
Console.WriteLine($"files in out/: {string.Join(", ", Directory.GetFiles("out", "*", SearchOption.AllDirectories))}");
 
// Opting in to Sanitize drops the ".." components and keeps the file inside the target.
Archive.Extract("upload.tar", "clean", new ArchiveExtractOptions { UnsafePaths = UnsafePathHandling.Sanitize });
Console.WriteLine($"files in clean/: {string.Join(", ", Directory.GetFiles("clean", "*", SearchOption.AllDirectories).Order())}");
 
// Limits: a 1 KiB budget for the whole archive.
Archive.Create("big.tar").Add(new ArchiveEntry { Name = "big.bin", Kind = ArchiveEntryKind.File, Size = 65536 }, new byte[65536]).Save();
try
{
    using var big = Archive.Open("big.tar", new ArchiveOpenOptions { Limits = new ArchiveLimits { MaxTotalSize = 1024 } });
    big.Extract("limited");
}
catch (CompressionLimitException e)
{
    Console.WriteLine($"limit: {e.LimitName}: {e.Message}");
}

entry: readme.txt
entry: ../../home/user/.bashrc
refused: rule path-traversal, entry ../../home/user/.bashrc
files in out/: out/readme.txt
files in clean/: clean/home/user/.bashrc, clean/readme.txt
limit: MaxTotalSize: tar: MaxTotalSize limit exceeded: the input needs 65536 but the limit is 1024