CodeVetter · Repo Unpack · Risk map
pytest-dev/pytest
The following are source observations and explicitly labeled hypotheses, not confirmed vulnerabilities. pytest intentionally imports and executes selected tests, plugins, and conftests in the invoking process. Filesystem boundaries include configurable cache directories, temporary roots, bytecode caches, and report destinations. Lifecycle and compatibility changes have a broad impact because plugins share internal execution and reporting hooks.
- Plugin autoload and explicit plugin imports execute installed or selected Python code; disabling pytest11 autoload still permits explicitly requested PYTEST_PLUGINS, and test modules are imported during collection.
- TempPathFactory.getbasetemp removes an existing explicitly supplied basetemp before recreating it; the default path lies under a system or PYTEST_DEBUG_TEMPROOT directory and includes ownership and symlink checks where UID information is available.
- Cache keys receive lexical containment validation, but _join_within does not resolve symlinks; hypothesis: protection against traversal through pre-existing filesystem links requires separate assessment. (inferred)
- Cache.set writes JSON directly to the destination, whereas cache-directory initialization and rewritten bytecode use rename/replace operations; hypothesis: concurrent independent cache writers can overwrite state or expose partial JSON, which readers then treat as a miss. (inferred)
- --pastebin=all uploads collected terminal output and --pastebin=failed uploads failure representations to https://bpa.st; create_new_paste calls urlopen without an explicit timeout and the feature emits a deprecation warning.
- Pytester.popen copies the parent environment, prepends the current directory to PYTHONPATH, and invokes subprocess.Popen; isolation changes must account for inherited state and child execution.
- JUnit sessionfinish creates parent directories and opens the configured logfile in write mode; assertion-cache loading unmarshals code and executes it after header and source-hash checks.
- Fixture-map changes already have a documented downstream compatibility impact: the BDD integration command is disabled, and fixture registration retains deprecated nodeid-based maps alongside preferred node-based registration.