tarfile-ignore-zeros-true
Preview (since 0.17.4) · Related issues · View source
This rule is unstable and in preview. The --preview flag is required for use.
What it does
Checks for tarfile archives opened with ignore_zeros=True.
Why is this bad?
By default, tarfile stops at the first empty block. ignore_zeros=True
makes it skip empty and invalid blocks and read on, a mode the Python
documentation recommends only for concatenated or damaged archives.
It is usually enabled to tolerate a missing end-of-archive marker, but it relaxes every other structural check too. The archive's contents then depend on how Python recovers from malformed data, so a crafted archive can yield different members here than under a stricter parser.
Example
Use instead: