Unintended behaviour in absltest.py
- Linguagem predominante
- Python
- Estrelas
- 2.5k
- Forks
- 279
- Merge médio
- 2d 1h
- PRs com merge (30d)
- 1
Descrição
It seems like this section of code allows someone to pass in an arbitrary path name in tempfile, which then causes the code to zero out the provided path (rather than a temporary file) if the person running the test also happens to own the file: https://github.com/abseil/abseil-py/blob/976413320682f8fd1c05c36f24a9475050702699/absl/testing/absltest.py#L390-L396
Example:
```
import pathlib
from adric-work.testing.pybase import test
class BugTest(test.TestCase):
def testBug(self):
# bad_path = pathlib.Path.home() / 'hello_bug' / 'a_file.txt'
# my_file = self.create_tempfile(bad_path.as_posix())
bad_path = '/usr/local/work/home/adric-work/hello_bug/a_file.txt'
my_file = self.create_tempfile(bad_path)
if __name__ == '__main__':
test.main()
```
Guia de contribuição
Direção de pesquisa
The issue points to lines 390-396 in absl/testing/absltest.py. Start by reading the create_tempfile method and understanding how it handles the file_path argument. Look at the surrounding code to see the security check for file ownership. Write a test that reproduces the bug by passing an existing file path. Verify the fix by ensuring the method only writes to a truly temporary file.
Escrita pelo modelo de indexação a partir do texto da issue.
Avaliação
- Stack de tecnologia
- python
- Domínio
- testing
- Tipo de issue
- Bug
- Dificuldade
- 3/5
- Tempo estimado
- 1-2 dias
- Status de atividade
- Estagnada
- Clareza
- Claramente especificada
- Facilidade para iniciantes
- 45/100