Python tarfile extraction needs an explicit filter policy

How to make Python tar extraction filters explicit and keep failed extraction paths contained.