Extract tar files with "data" filter in Windows build scripts (python-pillow#8606)

Co-authored-by: Andrew Murray <[email protected]>
Co-authored-by: Hugo van Kemenade <[email protected]>

Author: 2 people

winbuild/build_prepare.py

@@ -7,6 +7,7 @@
 import shutil
 import struct
 import subprocess
+import sys
 from typing import Any
 
 
@@ -507,7 +508,10 @@ def extract_dep(url: str, filename: str, prefs: dict[str, str]) -> None:
                 if sources_dir_abs != member_prefix:
                     msg = "Attempted Path Traversal in Tar File"
                     raise RuntimeError(msg)
-            tgz.extractall(sources_dir)
+            if sys.version_info >= (3, 12):
+                tgz.extractall(sources_dir, filter="data")
+            else:
+                tgz.extractall(sources_dir)
     else:
         msg = "Unknown archive type: " + filename
         raise RuntimeError(msg)