abseil / abseil/abseil-py

Unintended behaviour in absltest.py

Aberta
#248 0 comentários 0 reações 0 responsáveis Ver no GitHub
Linguagem predominante
Python
Estrelas
2.5k
Forks
279
Merge médio
2d 1h
PRs com merge (30d)
1

Descrição

It seems like this section of code allows someone to pass in an arbitrary path name in tempfile, which then causes the code to zero out the provided path (rather than a temporary file) if the person running the test also happens to own the file: https://github.com/abseil/abseil-py/blob/976413320682f8fd1c05c36f24a9475050702699/absl/testing/absltest.py#L390-L396
Example:
```
import pathlib

from adric-work.testing.pybase import test

class BugTest(test.TestCase):

def testBug(self):
# bad_path = pathlib.Path.home() / 'hello_bug' / 'a_file.txt'
# my_file = self.create_tempfile(bad_path.as_posix())
bad_path = '/usr/local/work/home/adric-work/hello_bug/a_file.txt'
my_file = self.create_tempfile(bad_path)

if __name__ == '__main__':
test.main()
```

Guia de contribuição

Abrir o guia de contribuição

Direção de pesquisa

The issue points to lines 390-396 in absl/testing/absltest.py. Start by reading the create_tempfile method and understanding how it handles the file_path argument. Look at the surrounding code to see the security check for file ownership. Write a test that reproduces the bug by passing an existing file path. Verify the fix by ensuring the method only writes to a truly temporary file.

Escrita pelo modelo de indexação a partir do texto da issue.

Avaliação

Stack de tecnologia
python
Domínio
testing
Tipo de issue
Bug
Dificuldade
3/5
Tempo estimado
1-2 dias
Status de atividade
Estagnada
Clareza
Claramente especificada
Facilidade para iniciantes
45/100

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.