Path traversal via archive.extract - CVE 2021-3281 incomplete patch

While performing a code review on previous vulnerability patches, I found that the fix for the CVE-2021-3281 is incomplete. Just as a reminder, in order to mitigate this vulnerability, the following guard logic has been added in the `extract` function of both `ZipArchive` and `TarArchive` classes …

# django/django/utils/archive.py
def target_filename(self, to_path, name):
    target_path = os.path.abspath(to_path)
    filename = os.path.abspath(os.path.join(target_path, name))
    if not filename.startswith(target_path):
        raise SuspiciousOperation("Archive contains invalid path: '%s'" …