Temp helpers allow paths outside test directory, breaking isolation
- 主要語言
- Python
- 星號
- 2.5k
- 分支
- 279
- 平均合併
- 2 天 1 小時
- 30 天內合併 PR
- 1
描述
### Summary
Temp file and directory helpers in `absl.testing.absltest` currently accept relative paths that can escape the test’s temporary directory (e.g., via `..`). This can create files or directories outside the intended test sandbox.
---
### Reproducible example
```python
from absl.testing import absltest
class ExampleTest(absltest.TestCase):
def test_escape(self):
tf = self.create_tempfile('../outside.txt')
print(tf.full_path) # points outside the test temp directory
```
Running this creates a file outside the test-specific temp directory.
---
### Observed behavior
* Relative paths like `"../outside.txt"` are accepted
* Resulting paths may resolve outside the test temp directory
* Cleanup may affect unintended directories depending on path structure
---
### Expected behavior
All temp helpers should ensure that created files and directories remain within the test’s temporary directory to preserve isolation guarantees.
---
### Why this matters
* Breaks test isolation (tests can write outside their sandbox)
* Makes cleanup behavior less predictable
* Can lead to interference between tests or with local filesystem state
---
### Proposed direction
Reject paths that:
* contain traversal components (e.g., `..`)
* are absolute paths
This would ensure all helper-created paths remain confined to the test temp directory.
---
### Notes
* This issue focuses on maintaining expected test isolation behavior
* No changes are proposed to valid relative paths within the temp directory
貢獻指南
研究方向
Look at the temp file and directory helpers in `absl/testing/absltest.py`. Start by finding the `create_tempfile` method and related helpers. Understand how paths are resolved relative to the test's temporary directory. The fix involves adding validation to reject paths containing '..' or absolute paths. Run the existing tests to ensure the change doesn't break existing functionality, and add a test case for the escaping behavior.
由索引模型根據 Issue 內容生成。
評估
- 技術堆疊
- python
- 領域
- testing
- Issue 類型
- 缺陷
- 難度
- 3/5
- 預估耗時
- 1-2 天
- 活躍度
- 冷清
- 描述清晰度
- 描述清楚
- 新手友好度
- 65/100