gh-79459: Sanitize the prefix and suffix parameters to the tempfile functions:

- `tempfile.mkdtemp`.
- `tempfile.mkstemp`.
- `tempfile.NamedTemporaryFile`.

Author: mbyrnepr2

Doc/whatsnew/3.15.rst

@@ -1593,6 +1593,13 @@ New deprecations
 
     (Contributed by Sergey B Kirpichev and Serhiy Storchaka in :gh:`143715`.)
 
+* :mod:`tempfile`:
+
+  * The ``prefix`` and ``suffix`` parameters of the tempfile functions,
+    :func:`tempfile.mkdtemp`, :func:`tempfile.mkstemp` and
+    :func:`tempfile.NamedTemporaryFile`, will be sanitized to use only the
+    basename of the provided values if they contain a directory separator.
+
 * ``__version__``
 
   * The ``__version__``, ``version`` and ``VERSION`` attributes have been

Lib/tempfile.py

@@ -117,11 +117,15 @@ def _sanitize_params(prefix, suffix, dir):
     output_type = _infer_return_type(prefix, suffix, dir)
     if suffix is None:
         suffix = output_type()
+    elif _os.path.dirname(suffix):
+        suffix = _os.path.basename(suffix)
     if prefix is None:
         if output_type is str:
             prefix = template
         else:
             prefix = _os.fsencode(template)
+    elif _os.path.dirname(prefix):
+        prefix = _os.path.basename(prefix)
     if dir is None:
         if output_type is str:
             dir = gettempdir()

Lib/test/test_tempfile.py

@@ -644,8 +644,10 @@ def do_create(self, dir=None, pre=None, suf=None):
                 dir = tempfile.gettempdirb()
         if pre is None:
             pre = output_type()
+        pre = os.path.basename(pre)
         if suf is None:
             suf = output_type()
+        suf = os.path.basename(suf)
         (fd, name) = tempfile.mkstemp(dir=dir, prefix=pre, suffix=suf)
         (ndir, nbase) = os.path.split(name)
         adir = os.path.abspath(dir)
@@ -666,6 +668,10 @@ def test_basic(self):
         self.do_create(pre="a", suf="b")
         self.do_create(pre="aa", suf=".txt")
         self.do_create(dir=".")
+        self.do_create(pre=f"{os.sep}myhome")
+        self.do_create(pre=os.fsencode(f"{os.sep}home"))
+        self.do_create(suf=f"{os.sep}home")
+        self.do_create(suf=os.fsencode(f"{os.sep}home"))
 
     def test_basic_with_bytes_names(self):
         # mkstemp can create files when given name parts all
@@ -743,6 +749,8 @@ def do_create(self, dir=None, pre=None, suf=None):
             pre = output_type()
         if suf is None:
             suf = output_type()
+        pre = os.path.basename(pre)
+        suf = os.path.basename(suf)
         name = tempfile.mkdtemp(dir=dir, prefix=pre, suffix=suf)
 
         try:
@@ -759,6 +767,10 @@ def test_basic(self):
         os.rmdir(self.do_create(suf="b"))
         os.rmdir(self.do_create(pre="a", suf="b"))
         os.rmdir(self.do_create(pre="aa", suf=".txt"))
+        os.rmdir(self.do_create(pre=f"{os.sep}home"))
+        os.rmdir(self.do_create(pre=os.fsencode(f"{os.sep}home")))
+        os.rmdir(self.do_create(suf=f"{os.sep}home"))
+        os.rmdir(self.do_create(suf=os.fsencode(f"{os.sep}home")))
 
     def test_basic_with_bytes_names(self):
         # mkdtemp can create directories when given all binary parts
@@ -962,9 +974,19 @@ def test_many(self):
 class TestNamedTemporaryFile(BaseTestCase):
     """Test NamedTemporaryFile()."""
 
-    def do_create(self, dir=None, pre="", suf="", delete=True):
+    def do_create(self, dir=None, pre=None, suf=None, delete=True):
+        output_type = tempfile._infer_return_type(dir, pre, suf)
         if dir is None:
-            dir = tempfile.gettempdir()
+            if output_type is str:
+                dir = tempfile.gettempdir()
+            else:
+                dir = tempfile.gettempdirb()
+        if pre is None:
+            pre = output_type()
+        if suf is None:
+            suf = output_type()
+        pre = os.path.basename(pre)
+        suf = os.path.basename(suf)
         file = tempfile.NamedTemporaryFile(dir=dir, prefix=pre, suffix=suf,
                                            delete=delete)
 
@@ -979,6 +1001,10 @@ def test_basic(self):
         self.do_create(suf="b")
         self.do_create(pre="a", suf="b")
         self.do_create(pre="aa", suf=".txt")
+        self.do_create(pre=f"{os.sep}home")
+        self.do_create(pre=os.fsencode(f"{os.sep}home"))
+        self.do_create(suf=f"{os.sep}home")
+        self.do_create(suf=os.fsencode(f"{os.sep}home"))
 
     def test_method_lookup(self):
         # Issue #18879: Looking up a temporary file method should keep it