tempfile:

Raise a ``ValueError`` if the ``prefix`` or ``suffix`` contains a
directory component.

gh-79459

Author: mbyrnepr2

Lib/tempfile.py

@@ -117,11 +117,15 @@ def _sanitize_params(prefix, suffix, dir):
     output_type = _infer_return_type(prefix, suffix, dir)
     if suffix is None:
         suffix = output_type()
+    if _os.path.dirname(suffix):
+        raise ValueError("'prefix' or 'suffix' can't contain a directory component")
     if prefix is None:
         if output_type is str:
             prefix = template
         else:
             prefix = _os.fsencode(template)
+    if _os.path.dirname(prefix):
+        raise ValueError("'prefix' or 'suffix' can't contain a directory component")
     if dir is None:
         if output_type is str:
             dir = gettempdir()

Lib/test/test_tempfile.py

@@ -2054,5 +2054,30 @@ def test_delete_false(self):
         self.assertTrue(os.path.exists(working_dir))
         shutil.rmtree(working_dir)
 
+
+class TestPrefixAndSuffix(BaseTestCase):
+    def test_value_error_if_prefix_or_suffix_contains_directory(self):
+        MESSAGE = "'prefix' or 'suffix' can't contain a directory component"
+
+        if os.altsep is None:
+            data = (
+                ((os.sep), None),
+                (os.fsencode(os.sep), tempfile.gettempdirb()),
+                )
+        else:
+            data = (
+                ((os.altsep), None),
+                (os.fsencode(os.altsep), tempfile.gettempdirb()),
+                )
+
+        for value, directory in data:
+            with self.subTest((value, directory)):
+                with self.assertRaisesRegex(ValueError, MESSAGE):
+                    tempfile.mkstemp(dir=directory, prefix=value)
+                with self.assertRaisesRegex(ValueError, MESSAGE):
+                    os.rmdir(tempfile.mkdtemp(dir=directory, prefix=value))
+                with self.assertRaisesRegex(ValueError, MESSAGE):
+                    tempfile.NamedTemporaryFile(dir=directory, prefix=value, delete=True)
+
 if __name__ == "__main__":
     unittest.main()