Yes, I've been thinking of doing something more straightforward instead:
When extracting a file named A/B/C/D, make sure that A, A/B, and A/B/C all fall under the target directory (this is the current directory by default; or it can the directory established by -C). Similarly for A/B/C/D in the non-default case where D is not unlinked before re-creating it.
The obvious implementation of this is slow because it's redoing namei in user space. However, I know how to make it almost as as fast as tar is now, at least on GNU/Linux; just haven't gotten around to implementing it yet.
