cat > /tmp/repro_b202_extract_fn.py <<'PY'
import tarfile
import tempfile
from pathlib import Path
def unsafe_archive_handler(filename):
    target_dir = Path(tempfile.mkdtemp())
    tar = tarfile.open(filename)
    for member in tar.getmembers():
        # Vulnerable: no validation of member.name/linkname
        tar.extract(member, path=target_dir)
    tar.close()
PY
bandit -r /tmp/repro_b202_extract_fn.py -t B202