fix #5686, mktemp now fails given absolute and non-normalized paths.

changelog/5686.improvement.rst

@@ -0,0 +1 @@
+``tmpdir_factory.mktemp`` now fails when given absolute and non-normalized paths.

src/_pytest/tmpdir.py

@@ -45,8 +45,17 @@ class TempPathFactory:
             given_basetemp=config.option.basetemp, trace=config.trace.get("tmpdir")
         )
 
+    def _ensure_relative_to_basetemp(self, basename: str):
+        basename = os.path.normpath(basename)
+        if (self.getbasetemp() / basename).resolve().parent != self.getbasetemp():
+            raise ValueError(
+                "{} is not a normalized and relative path".format(basename)
+            )
+        return basename
+
     def mktemp(self, basename: str, numbered: bool = True) -> Path:
         """makes a temporary directory managed by the factory"""
+        basename = self._ensure_relative_to_basetemp(basename)
         if not numbered:
             p = self.getbasetemp().joinpath(basename)
             p.mkdir()

testing/test_tmpdir.py

@@ -74,19 +74,38 @@ class TestConfigTmpdir:
         assert not mytemp.join("hello").check()
 
 
-def test_basetemp(testdir):
+testdata = [
+    ("mypath", True),
+    ("/mypath1", False),
+    ("./mypath1", True),
+    ("../mypath3", False),
+    ("../../mypath4", False),
+    ("mypath5/..", False),
+    ("mypath6/../mypath6", True),
+    ("mypath7/../mypath7/..", False),
+]
+
+
+@pytest.mark.parametrize("basename, is_ok", testdata)
+def test_mktemp(testdir, basename, is_ok):
     mytemp = testdir.tmpdir.mkdir("mytemp")
     p = testdir.makepyfile(
         """
         import pytest
-        def test_1(tmpdir_factory):
+        def test_abs_path(tmpdir_factory):
-            tmpdir_factory.mktemp('hello', numbered=False)
+            tmpdir_factory.mktemp('{}', numbered=False)
-    """
+        """.format(
+            basename
         )
+    )
+
     result = testdir.runpytest(p, "--basetemp=%s" % mytemp)
+    if is_ok:
         assert result.ret == 0
-    print(mytemp)
+        assert mytemp.join(basename).check()
-    assert mytemp.join("hello").check()
+    else:
+        assert result.ret == 1
+        result.stdout.fnmatch_lines("*ValueError*")
 
 
 def test_tmpdir_always_is_realpath(testdir):