merge revision(s) 2ecfb88e: [Backport #16918]

	Correctly remove temporary directory if path yielded is mutated
	
	Another approach would be to freeze the string, but that could
	cause backwards compatibility issues.
	
	Fixes [Bug #16918]


git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_6@67910 b2dd03c8-39d4-4d8f-98ff-823fe69b080e

3 files changed, 30 insertions, 12 deletions

diff --git a/lib/tmpdir.rb b/lib/tmpdir.rb
index 87e53a83be..9d61595ec2 100644
--- a/lib/tmpdir.rb
+++ b/lib/tmpdir.rb
@@ -90,7 +90,7 @@ class Dir
     }
     if block_given?
       begin
-        yield path
+        yield path.dup
       ensure
         unless base
           stat = File.stat(File.dirname(path))
diff --git a/test/test_tmpdir.rb b/test/test_tmpdir.rb
index 1e633d233b..bede8c0ab4 100644
--- a/test/test_tmpdir.rb
+++ b/test/test_tmpdir.rb
@@ -65,22 +65,40 @@ class TestTmpdir < Test::Unit::TestCase
     }
   end
 
-  TRAVERSAL_PATH = Array.new(Dir.pwd.split('/').count, '..').join('/') + Dir.pwd + '/'
-  TRAVERSAL_PATH.delete!(':') if /mswin|mingw/ =~ RUBY_PLATFORM
+  def test_mktmpdir_mutate
+    bug16918 = '[ruby-core:98563]'
+    assert_nothing_raised(bug16918) do
+      assert_mktmpdir_traversal do |traversal_path|
+        Dir.mktmpdir(traversal_path + 'foo') do |actual|
+          actual << "foo"
+        end
+      end
+    end
+  end
 
   def test_mktmpdir_traversal
-    expect = Dir.glob(TRAVERSAL_PATH + '*').count
-    Dir.mktmpdir(TRAVERSAL_PATH + 'foo') do
-      actual = Dir.glob(TRAVERSAL_PATH + '*').count
-      assert_equal expect, actual
+    assert_mktmpdir_traversal do |traversal_path|
+      Dir.mktmpdir(traversal_path + 'foo') do |actual|
+        actual
+      end
     end
   end
 
   def test_mktmpdir_traversal_array
-    expect = Dir.glob(TRAVERSAL_PATH + '*').count
-    Dir.mktmpdir([TRAVERSAL_PATH, 'foo']) do
-      actual = Dir.glob(TRAVERSAL_PATH + '*').count
-      assert_equal expect, actual
+    assert_mktmpdir_traversal do |traversal_path|
+      Dir.mktmpdir([traversal_path, 'foo']) do |actual|
+        actual
+      end
+    end
+  end
+
+  def assert_mktmpdir_traversal
+    Dir.mktmpdir do |target|
+      target = target.chomp('/') + '/'
+      traversal_path = target.sub(/\A\w:/, '') # for DOSISH
+      traversal_path = Array.new(target.count('/')-2, '..').join('/') + traversal_path
+      actual = yield traversal_path
+      assert_not_send([File.absolute_path(actual), :start_with?, target])
     end
   end
 end
diff --git a/version.h b/version.h
index 60974d0a62..616e6f3181 100644
--- a/version.h
+++ b/version.h
@@ -1,6 +1,6 @@
 #define RUBY_VERSION "2.6.7"
 #define RUBY_RELEASE_DATE "2021-03-02"
-#define RUBY_PATCHLEVEL 169
+#define RUBY_PATCHLEVEL 170
 
 #define RUBY_RELEASE_YEAR 2021
 #define RUBY_RELEASE_MONTH 3