abseil / abseil/abseil-py

Temp helpers allow paths outside test directory, breaking isolation

オープン
#414 コメント 2 件 リアクション 0 件 担当者 0 名 GitHub で見る
主要言語
Python
スター
2.5k
フォーク
279
平均マージ
2日 1時間
マージ済み PR(30日)
1

説明

### Summary

Temp file and directory helpers in `absl.testing.absltest` currently accept relative paths that can escape the test’s temporary directory (e.g., via `..`). This can create files or directories outside the intended test sandbox.

---

### Reproducible example

```python
from absl.testing import absltest

class ExampleTest(absltest.TestCase):
def test_escape(self):
tf = self.create_tempfile('../outside.txt')
print(tf.full_path) # points outside the test temp directory
```

Running this creates a file outside the test-specific temp directory.

---

### Observed behavior

* Relative paths like `"../outside.txt"` are accepted
* Resulting paths may resolve outside the test temp directory
* Cleanup may affect unintended directories depending on path structure

---

### Expected behavior

All temp helpers should ensure that created files and directories remain within the test’s temporary directory to preserve isolation guarantees.

---

### Why this matters

* Breaks test isolation (tests can write outside their sandbox)
* Makes cleanup behavior less predictable
* Can lead to interference between tests or with local filesystem state

---

### Proposed direction

Reject paths that:

* contain traversal components (e.g., `..`)
* are absolute paths

This would ensure all helper-created paths remain confined to the test temp directory.

---

### Notes

* This issue focuses on maintaining expected test isolation behavior
* No changes are proposed to valid relative paths within the temp directory

コントリビューションガイド

コントリビューションガイドを開く

評価

この issue はまだ評価されていません。

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。