tmpdir_factory.mktemp now fails given absolute and non-normaliz… (#6323)

tmpdir_factory.mktemp now fails given absolute and non-normalized paths.

changelog/5686.improvement.rst

@@ -0,0 +1 @@
+``tmpdir_factory.mktemp`` now fails when given absolute and non-normalized paths.

src/_pytest/tmpdir.py

@@ -45,8 +45,30 @@ class TempPathFactory:
             given_basetemp=config.option.basetemp, trace=config.trace.get("tmpdir")
         )
 
+    def _ensure_relative_to_basetemp(self, basename: str):
+        basename = os.path.normpath(basename)
+        if (self.getbasetemp() / basename).resolve().parent != self.getbasetemp():
+            raise ValueError(
+                "{} is not a normalized and relative path".format(basename)
+            )
+        return basename
+
     def mktemp(self, basename: str, numbered: bool = True) -> Path:
-        """makes a temporary directory managed by the factory"""
+        """Creates a new temporary directory managed by the factory.
+
+        :param basename:
+            Directory base name, must be a relative path.
+
+        :param numbered:
+            If True, ensure the directory is unique by adding a number
+            prefix greater than any existing one: ``basename="foo"`` and ``numbered=True``
+            means that this function will create directories named ``"foo-0"``,
+            ``"foo-1"``, ``"foo-2"`` and so on.
+
+        :return:
+            The path to the new directory.
+        """
+        basename = self._ensure_relative_to_basetemp(basename)
         if not numbered:
             p = self.getbasetemp().joinpath(basename)
             p.mkdir()
@@ -90,10 +112,9 @@ class TempdirFactory:
 
     _tmppath_factory = attr.ib(type=TempPathFactory)
 
-    def mktemp(self, basename: str, numbered: bool = True):
-        """Create a subdirectory of the base temporary directory and return it.
-        If ``numbered``, ensure the directory is unique by adding a number
-        prefix greater than any existing one.
+    def mktemp(self, basename: str, numbered: bool = True) -> py.path.local:
+        """
+        Same as :meth:`TempPathFactory.mkdir`, but returns a ``py.path.local`` object.
         """
         return py.path.local(self._tmppath_factory.mktemp(basename, numbered).resolve())
 

testing/test_tmpdir.py

@@ -74,19 +74,38 @@ class TestConfigTmpdir:
         assert not mytemp.join("hello").check()
 
 
-def test_basetemp(testdir):
+testdata = [
+    ("mypath", True),
+    ("/mypath1", False),
+    ("./mypath1", True),
+    ("../mypath3", False),
+    ("../../mypath4", False),
+    ("mypath5/..", False),
+    ("mypath6/../mypath6", True),
+    ("mypath7/../mypath7/..", False),
+]
+
+
+@pytest.mark.parametrize("basename, is_ok", testdata)
+def test_mktemp(testdir, basename, is_ok):
     mytemp = testdir.tmpdir.mkdir("mytemp")
     p = testdir.makepyfile(
         """
         import pytest
-        def test_1(tmpdir_factory):
-            tmpdir_factory.mktemp('hello', numbered=False)
-    """
+        def test_abs_path(tmpdir_factory):
+            tmpdir_factory.mktemp('{}', numbered=False)
+        """.format(
+            basename
+        )
     )
+
     result = testdir.runpytest(p, "--basetemp=%s" % mytemp)
-    assert result.ret == 0
-    print(mytemp)
-    assert mytemp.join("hello").check()
+    if is_ok:
+        assert result.ret == 0
+        assert mytemp.join(basename).check()
+    else:
+        assert result.ret == 1
+        result.stdout.fnmatch_lines("*ValueError*")
 
 
 def test_tmpdir_always_is_realpath(testdir):