abseil / abseil/abseil-py

Temp helpers allow paths outside test directory, breaking isolation

未關閉
#414 2 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視
主要語言
Python
星號
2.5k
分支
279
平均合併
2 天 1 小時
30 天內合併 PR
1

描述

### Summary

Temp file and directory helpers in `absl.testing.absltest` currently accept relative paths that can escape the test’s temporary directory (e.g., via `..`). This can create files or directories outside the intended test sandbox.

---

### Reproducible example

```python
from absl.testing import absltest

class ExampleTest(absltest.TestCase):
def test_escape(self):
tf = self.create_tempfile('../outside.txt')
print(tf.full_path) # points outside the test temp directory
```

Running this creates a file outside the test-specific temp directory.

---

### Observed behavior

* Relative paths like `"../outside.txt"` are accepted
* Resulting paths may resolve outside the test temp directory
* Cleanup may affect unintended directories depending on path structure

---

### Expected behavior

All temp helpers should ensure that created files and directories remain within the test’s temporary directory to preserve isolation guarantees.

---

### Why this matters

* Breaks test isolation (tests can write outside their sandbox)
* Makes cleanup behavior less predictable
* Can lead to interference between tests or with local filesystem state

---

### Proposed direction

Reject paths that:

* contain traversal components (e.g., `..`)
* are absolute paths

This would ensure all helper-created paths remain confined to the test temp directory.

---

### Notes

* This issue focuses on maintaining expected test isolation behavior
* No changes are proposed to valid relative paths within the temp directory

貢獻指南

開啟貢獻指南

研究方向

Look at the temp file and directory helpers in `absl/testing/absltest.py`. Start by finding the `create_tempfile` method and related helpers. Understand how paths are resolved relative to the test's temporary directory. The fix involves adding validation to reject paths containing '..' or absolute paths. Run the existing tests to ensure the change doesn't break existing functionality, and add a test case for the escaping behavior.

由索引模型根據 Issue 內容生成。

評估

技術堆疊
python
領域
testing
Issue 類型
缺陷
難度
3/5
預估耗時
1-2 天
活躍度
冷清
描述清晰度
描述清楚
新手友好度
65/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。