Temp helpers allow paths outside test directory, breaking isolation
- 主要言語
- Python
- スター
- 2.5k
- フォーク
- 279
- 平均マージ
- 2日 1時間
- マージ済み PR(30日)
- 1
説明
### Summary
Temp file and directory helpers in `absl.testing.absltest` currently accept relative paths that can escape the test’s temporary directory (e.g., via `..`). This can create files or directories outside the intended test sandbox.
---
### Reproducible example
```python
from absl.testing import absltest
class ExampleTest(absltest.TestCase):
def test_escape(self):
tf = self.create_tempfile('../outside.txt')
print(tf.full_path) # points outside the test temp directory
```
Running this creates a file outside the test-specific temp directory.
---
### Observed behavior
* Relative paths like `"../outside.txt"` are accepted
* Resulting paths may resolve outside the test temp directory
* Cleanup may affect unintended directories depending on path structure
---
### Expected behavior
All temp helpers should ensure that created files and directories remain within the test’s temporary directory to preserve isolation guarantees.
---
### Why this matters
* Breaks test isolation (tests can write outside their sandbox)
* Makes cleanup behavior less predictable
* Can lead to interference between tests or with local filesystem state
---
### Proposed direction
Reject paths that:
* contain traversal components (e.g., `..`)
* are absolute paths
This would ensure all helper-created paths remain confined to the test temp directory.
---
### Notes
* This issue focuses on maintaining expected test isolation behavior
* No changes are proposed to valid relative paths within the temp directory
コントリビューションガイド
評価
この issue はまだ評価されていません。