[saberoueslati]

Summary

Adds the preview rule tarfile-ignore-zeros-true for statically truthy ignore_zeros in tarfile openers. This setting skips empty and invalid blocks, so an archive may yield members that a parser stopping at those blocks would not see. The rule covers tarfile.open, TarFile(...), and TarFile opening class methods.

Closes #27310

Test Plan

The new mdtest covers flagged and unflagged calls. The targeted mdtest passes.

[astral-sh-bot]

ruff-ecosystem results

Linter (stable)

✅ ecosystem check detected no linter changes.

Linter (preview)

✅ ecosystem check detected no linter changes.

[ntBre]

Thanks for looking into this. I had one question about the covered APIs and a question about the rule code.

Could you say how you chose the linter and rule code for this rule? I don't see this in the list of upstream codes, so I don't think we should useS203 here. Given our new categories, I think we could just make this a security rule (as you've already done) without assigning a code at all, like this rule:

ruff/crates/ruff_linter/src/codes.rs

Lines 1371 to 1372 in 348d2dc

	// Rules that belong only to categories, without linter groups or codes.
	() => rules::ruff::rules::PytestFixtureAutouse,

[ntBre]

Are these documented somewhere? I don't see them in the docs.

[saberoueslati]

They aren't. Those class methods exist in CPython and typeshed, but the tarfile docs don't cover them, so I've removed them from the rule and the tests. The rule now checks tarfile.open, TarFile.open, and the TarFile constructor, which matches the documented API and #27310.

[saberoueslati]

@ntBre done as asked.

[ntBre]

Thank you! I took care of the merge conflict and added the rule to the call_with_qualified_name runner added today.