📝 Description

Summary

Fix SafeTarExtractor._extract_file() to detect truncated file data. When a tar member's declared size metadata exceeds the actual available data, the method previously broke out of the read loop silently and renamed the incomplete temp file to the target path, allowing corrupted or partially-controlled payloads to be written to disk.

Changes

security/tar_safe.py

• _extract_file(): Replaced the silent break with an explicit UnsafeTarError when src.read() returns empty bytes before bytes_copied reaches member.size. The exception propagates to the outer try/except block which cleans up the temp file before re-raising.

tests/test_security.py

• test_truncated_file_detection: New test that creates a valid tar, truncates the file to cut off part of the data, and verifies that extraction raises UnsafeTarError.
  </｜DSML｜parameter>
  </｜DSML｜invoke>
  </｜DSML｜tool_calls>

🔗 Linked Issue

Closes #1544

📋 Contribution Checklist

• I have verified that my files are placed in the correct directory.
• I have tested my changes thoroughly on my local machine.
• GSSoC 2026: I have been formally assigned to this issue and noted it above.