From 1278f8b97e28b8d8058b57de241636d4225e0a52 Mon Sep 17 00:00:00 2001
From: Ran Benita <ran@unusedvar.com>
Date: Sat, 6 Mar 2021 17:01:29 +0200
Subject: [PATCH] tmpdir: fix temporary directories created with world-readable
permissions
(Written for a Unix system, but might be applicable to Windows as well).
pytest creates a root temporary directory under /tmp, named
`pytest-of-<username>`, and creates tmp_path's and other under it.
/tmp is shared between all users of the system.
This root temporary directory was created with 0o777&~umask permissions,
which usually becomes 0o755, meaning any user in the system could list
and read the files, which is undesirable.
Use 0o700 permissions instead. Also for subdirectories, because the root
dir is adjustable.
---
changelog/8414.bugfix.rst | 5 +++++
src/_pytest/pathlib.py | 12 ++++++++----
src/_pytest/pytester.py | 4 ++--
src/_pytest/tmpdir.py | 18 +++++++++++-------
testing/test_tmpdir.py | 16 ++++++++++++++++
5 files changed, 42 insertions(+), 13 deletions(-)
create mode 100644 changelog/8414.bugfix.rst
diff --git a/changelog/8414.bugfix.rst b/changelog/8414.bugfix.rst
new file mode 100644
index 000000000..a8b791ae2
--- /dev/null
+++ b/changelog/8414.bugfix.rst
@@ -0,0 +1,5 @@
+pytest used to create directories under ``/tmp`` with world-readable
+permissions. This means that any user in the system was able to read
+information written by tests in temporary directories (such as those created by
+the ``tmp_path``/``tmpdir`` fixture). Now the directories are created with
+private permissions.
diff --git a/src/_pytest/pathlib.py b/src/_pytest/pathlib.py
index eaae09083..e86811f12 100644
--- a/src/_pytest/pathlib.py
+++ b/src/_pytest/pathlib.py
@@ -205,7 +205,7 @@ def _force_symlink(
pass
-def make_numbered_dir(root: Path, prefix: str) -> Path:
+def make_numbered_dir(root: Path, prefix: str, mode: int = 0o700) -> Path:
"""Create a directory with an increased number as suffix for the given prefix."""
for i in range(10):
# try up to 10 times to create the folder
@@ -213,7 +213,7 @@ def make_numbered_dir(root: Path, prefix: str) -> Path:
new_number = max_existing + 1
new_path = root.joinpath(f"{prefix}{new_number}")
try:
- new_path.mkdir()
+ new_path.mkdir(mode=mode)
except Exception:
pass
else:
@@ -345,13 +345,17 @@ def cleanup_numbered_dir(
def make_numbered_dir_with_cleanup(
- root: Path, prefix: str, keep: int, lock_timeout: float
+ root: Path,
+ prefix: str,
+ keep: int,
+ lock_timeout: float,
+ mode: int,
) -> Path:
"""Create a numbered dir with a cleanup lock and remove old ones."""
e = None
for i in range(10):
try:
- p = make_numbered_dir(root, prefix)
+ p = make_numbered_dir(root, prefix, mode)
lock_path = create_cleanup_lock(p)
register_cleanup_lock_removal(lock_path)
except Exception as exc:
diff --git a/src/_pytest/pytester.py b/src/_pytest/pytester.py
index 968a53651..5a29c8eae 100644
--- a/src/_pytest/pytester.py
+++ b/src/_pytest/pytester.py
@@ -1456,7 +1456,7 @@ class Pytester:
:py:class:`Pytester.TimeoutExpired`.
"""
__tracebackhide__ = True
- p = make_numbered_dir(root=self.path, prefix="runpytest-")
+ p = make_numbered_dir(root=self.path, prefix="runpytest-", mode=0o700)
args = ("--basetemp=%s" % p,) + args
plugins = [x for x in self.plugins if isinstance(x, str)]
if plugins:
@@ -1475,7 +1475,7 @@ class Pytester:
The pexpect child is returned.
"""
basetemp = self.path / "temp-pexpect"
- basetemp.mkdir()
+ basetemp.mkdir(mode=0o700)
invoke = " ".join(map(str, self._getpytestargs()))
cmd = f"{invoke} --basetemp={basetemp} {string}"
return self.spawn(cmd, expect_timeout=expect_timeout)
diff --git a/src/_pytest/tmpdir.py b/src/_pytest/tmpdir.py
index 309754fdd..275ec7334 100644
--- a/src/_pytest/tmpdir.py
+++ b/src/_pytest/tmpdir.py
@@ -94,14 +94,14 @@ class TempPathFactory:
basename = self._ensure_relative_to_basetemp(basename)
if not numbered:
p = self.getbasetemp().joinpath(basename)
- p.mkdir()
+ p.mkdir(mode=0o700)
else:
- p = make_numbered_dir(root=self.getbasetemp(), prefix=basename)
+ p = make_numbered_dir(root=self.getbasetemp(), prefix=basename, mode=0o700)
self._trace("mktemp", p)
return p
def getbasetemp(self) -> Path:
- """Return base temporary directory."""
+ """Return the base temporary directory, creating it if needed."""
if self._basetemp is not None:
return self._basetemp
@@ -109,7 +109,7 @@ class TempPathFactory:
basetemp = self._given_basetemp
if basetemp.exists():
rm_rf(basetemp)
- basetemp.mkdir()
+ basetemp.mkdir(mode=0o700)
basetemp = basetemp.resolve()
else:
from_env = os.environ.get("PYTEST_DEBUG_TEMPROOT")
@@ -119,13 +119,17 @@ class TempPathFactory:
# make_numbered_dir() call
rootdir = temproot.joinpath(f"pytest-of-{user}")
try:
- rootdir.mkdir(exist_ok=True)
+ rootdir.mkdir(mode=0o700, exist_ok=True)
except OSError:
# getuser() likely returned illegal characters for the platform, use unknown back off mechanism
rootdir = temproot.joinpath("pytest-of-unknown")
- rootdir.mkdir(exist_ok=True)
+ rootdir.mkdir(mode=0o700, exist_ok=True)
basetemp = make_numbered_dir_with_cleanup(
- prefix="pytest-", root=rootdir, keep=3, lock_timeout=LOCK_TIMEOUT
+ prefix="pytest-",
+ root=rootdir,
+ keep=3,
+ lock_timeout=LOCK_TIMEOUT,
+ mode=0o700,
)
assert basetemp is not None, basetemp
self._basetemp = basetemp
diff --git a/testing/test_tmpdir.py b/testing/test_tmpdir.py
index 63450eab2..2ae23ffca 100644
--- a/testing/test_tmpdir.py
+++ b/testing/test_tmpdir.py
@@ -454,3 +454,19 @@ def test_tmp_path_factory_handles_invalid_dir_characters(
monkeypatch.setattr(tmp_path_factory, "_given_basetemp", None)
p = tmp_path_factory.getbasetemp()
assert "pytest-of-unknown" in str(p)
+
+
+@pytest.mark.skipif(not hasattr(os, "getuid"), reason="checks unix permissions")
+def test_tmp_path_factory_create_directory_with_safe_permissions(
+ tmp_path: Path, monkeypatch: MonkeyPatch
+) -> None:
+ """Verify that pytest creates directories under /tmp with private permissions."""
+ # Use the test's tmp_path as the system temproot (/tmp).
+ monkeypatch.setenv("PYTEST_DEBUG_TEMPROOT", str(tmp_path))
+ tmp_factory = TempPathFactory(None, lambda *args: None, _ispytest=True)
+ basetemp = tmp_factory.getbasetemp()
+
+ # No world-readable permissions.
+ assert (basetemp.stat().st_mode & 0o077) == 0
+ # Parent too (pytest-of-foo).
+ assert (basetemp.parent.stat().st_mode & 0o077) == 0