Code

Opened 3 years ago

Closed 3 years ago

Last modified 3 years ago

#15768 closed Cleanup/optimization (fixed)

The setUp() method FileStorageTests in tests/regressiontests/file_storage/tests.py uses tempfile.mktemp()

Reported by: d1b Owned by: elbarto
Component: Testing framework Version: master
Severity: Normal Keywords:
Cc: Triage Stage: Ready for checkin
Has patch: yes Needs documentation: no
Needs tests: no Patch needs improvement: no
Easy pickings: no UI/UX:

Description (last modified by lrekucki)

The tempfile.mktemp() function is deprecated and the documentation warns that the "Use of this function may introduce a security hole in your program" - see http://docs.python.org/library/tempfile.html#tempfile.mktemp for more information.

The setUp() method FileStorageTests in tests/regressiontests/file_storage/tests.py uses tempfile.mktemp() in creating a temporary directory. The temporary directory is then deleted during tearDown():

class FileStorageTests(unittest.TestCase):
    storage_class = FileSystemStorage

    def setUp(self):
        self.temp_dir = tempfile.mktemp()
        os.makedirs(self.temp_dir)
        self.storage = self.storage_class(location=self.temp_dir,
            base_url='/test_media_url/')

    def tearDown(self):
        shutil.rmtree(self.temp_dir)

This seems like a mistake because other classes such as FileSaveRaceConditionTest use tempfile.mkdtemp(). tempfile.mkdtemp is a safer way of creating a temporary directory.

Something like the following (_NOTE_: I haven't tested this) could be a 'fix'.

-        self.temp_dir = tempfile.mktemp()
-        os.makedirs(self.temp_dir)
+        self.temp_dir = tempfile.mkdtemp()

Attachments (2)

patch.diff (1.0 KB) - added by elbarto 3 years ago.
15768.diff (1.0 KB) - added by graham_king 3 years ago.
Updated to apply cleanly to latest svn version

Download all attachments as: .zip

Change History (8)

comment:2 Changed 3 years ago by lrekucki

  • Description modified (diff)
  • Triage Stage changed from Unreviewed to Accepted
  • Type changed from Uncategorized to Cleanup/optimization

Reformated description so it's easier to read.

comment:3 Changed 3 years ago by elbarto

  • Easy pickings unset
  • Needs documentation unset
  • Needs tests unset
  • Owner changed from nobody to elbarto
  • Patch needs improvement unset

Changed 3 years ago by elbarto

comment:4 Changed 3 years ago by elbarto

  • Has patch set

Changed 3 years ago by graham_king

Updated to apply cleanly to latest svn version

comment:5 Changed 3 years ago by graham_king

  • Component changed from Uncategorized to Testing framework
  • milestone set to 1.4
  • Triage Stage changed from Accepted to Ready for checkin
  • Version changed from 1.3 to SVN

Patch applies cleanly. Fixes the problem. Tests still pass.

comment:6 Changed 3 years ago by ramiro

  • Resolution set to fixed
  • Status changed from new to closed

Fixed in [16267].

comment:7 Changed 3 years ago by jacob

  • milestone 1.4 deleted

Milestone 1.4 deleted

Add Comment

Modify Ticket

Change Properties
<Author field>
Action
as closed
as The resolution will be set. Next status will be 'closed'
The resolution will be deleted. Next status will be 'new'
Author


E-mail address and user name can be saved in the Preferences.

 
Note: See TracTickets for help on using tickets.