Module containment 

Entry-path containment: the single decision point for whether an archive entry’s name (or a symlink’s target) may be written under a destination directory.

Pure and filesystem-free by design — see the module-level doc comments on each function for why.

Functions

check_symlink_target

Refuses a symlink whose target would resolve outside dest.

safe_join

Joins entry_name onto dest, refusing anything that escapes.