From ad7392754b256400cfde1d9026816444b78d5e27 Mon Sep 17 00:00:00 2001
From: naruse <naruse@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
Date: Wed, 28 Mar 2018 09:26:00 +0000
Subject: Remove directory separators

git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@62971 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
---
 lib/tmpdir.rb         |  2 ++
 test/test_tempfile.rb | 28 +++++++++++++++++++++++++++-
 test/test_tmpdir.rb   | 16 ++++++++++++++++
 3 files changed, 45 insertions(+), 1 deletion(-)

diff --git a/lib/tmpdir.rb b/lib/tmpdir.rb
index e30004c0bb..7c2651efbb 100644
--- a/lib/tmpdir.rb
+++ b/lib/tmpdir.rb
@@ -114,10 +114,12 @@ class Dir
       end
       n = nil
       prefix, suffix = basename
+      prefix = prefix.delete("#{File::SEPARATOR}#{File::ALT_SEPARATOR}")
       prefix = (String.try_convert(prefix) or
                 raise ArgumentError, "unexpected prefix: #{prefix.inspect}")
       suffix &&= (String.try_convert(suffix) or
                   raise ArgumentError, "unexpected suffix: #{suffix.inspect}")
+      suffix &&= suffix.delete("#{File::SEPARATOR}#{File::ALT_SEPARATOR}")
       begin
         t = Time.now.strftime("%Y%m%d")
         path = "#{prefix}#{t}-#{$$}-#{rand(0x100000000).to_s(36)}"\
diff --git a/test/test_tempfile.rb b/test/test_tempfile.rb
index 465ce42e36..6b7860fe20 100644
--- a/test/test_tempfile.rb
+++ b/test/test_tempfile.rb
@@ -371,5 +371,31 @@ puts Tempfile.new('foo').path
     }
     assert_file.not_exist?(path)
   end
-end
 
+  TRAVERSAL_PATH = Array.new(Dir.pwd.split('/').count, '..').join('/') + Dir.pwd + '/'
+
+  def test_open_traversal_dir
+    expect = Dir.glob(TRAVERSAL_PATH + '*').count
+    t = Tempfile.open([TRAVERSAL_PATH, 'foo'])
+    actual = Dir.glob(TRAVERSAL_PATH + '*').count
+    assert_equal expect, actual
+  ensure
+    t.close!
+  end
+
+  def test_new_traversal_dir
+    expect = Dir.glob(TRAVERSAL_PATH + '*').count
+    t = Tempfile.new(TRAVERSAL_PATH + 'foo')
+    actual = Dir.glob(TRAVERSAL_PATH + '*').count
+    assert_equal expect, actual
+  ensure
+    t.close!
+  end
+
+  def test_create_traversal_dir
+    expect = Dir.glob(TRAVERSAL_PATH + '*').count
+    Tempfile.create(TRAVERSAL_PATH + 'foo')
+    actual = Dir.glob(TRAVERSAL_PATH + '*').count
+    assert_equal expect, actual
+  end
+end
diff --git a/test/test_tmpdir.rb b/test/test_tmpdir.rb
index 691d52f3cb..d05ffc934a 100644
--- a/test/test_tmpdir.rb
+++ b/test/test_tmpdir.rb
@@ -56,4 +56,20 @@ class TestTmpdir < Test::Unit::TestCase
       assert_kind_of(String, d)
     }
   end
+
+  TRAVERSAL_PATH = Array.new(Dir.pwd.split('/').count, '..').join('/') + Dir.pwd + '/'
+
+  def test_mktmpdir_traversal
+    expect = Dir.glob(TRAVERSAL_PATH + '*').count
+    Dir.mktmpdir(TRAVERSAL_PATH + 'foo')
+    actual = Dir.glob(TRAVERSAL_PATH + '*').count
+    assert_equal expect, actual
+  end
+
+  def test_mktmpdir_traversal_array
+    expect = Dir.glob(TRAVERSAL_PATH + '*').count
+    Dir.mktmpdir([TRAVERSAL_PATH, 'foo'])
+    actual = Dir.glob(TRAVERSAL_PATH + '*').count
+    assert_equal expect, actual
+  end
 end
-- 
cgit v1.2.3