1 files changed, 123 insertions, 115 deletions
diff --git a/test/test_submodule.py b/test/test_submodule.py
index 13878df2..98222641 100644
--- a/test/test_submodule.py
+++ b/test/test_submodule.py
@@ -1101,139 +1101,147 @@ class TestSubmodule(TestBase):
 
     @with_rw_repo("HEAD")
     def test_submodule_add_unsafe_url(self, rw_repo):
-        tmp_dir = Path(tempfile.mkdtemp())
-        tmp_file = tmp_dir / "pwn"
-        urls = [
-            f"ext::sh -c touch% {tmp_file}",
-            "fd::/foo",
-        ]
-        for url in urls:
-            with self.assertRaises(UnsafeProtocolError):
-                Submodule.add(rw_repo, "new", "new", url)
-            assert not tmp_file.exists()
+        with tempfile.TemporaryDirectory() as tdir:
+            tmp_dir = Path(tdir)
+            tmp_file = tmp_dir / "pwn"
+            urls = [
+                f"ext::sh -c touch% {tmp_file}",
+                "fd::/foo",
+            ]
+            for url in urls:
+                with self.assertRaises(UnsafeProtocolError):
+                    Submodule.add(rw_repo, "new", "new", url)
+                assert not tmp_file.exists()
 
     @with_rw_repo("HEAD")
     def test_submodule_add_unsafe_url_allowed(self, rw_repo):
-        tmp_dir = Path(tempfile.mkdtemp())
-        tmp_file = tmp_dir / "pwn"
-        urls = [
-            f"ext::sh -c touch% {tmp_file}",
-            "fd::/foo",
-        ]
-        for url in urls:
-            # The URL will be allowed into the command, but the command will
-            # fail since we don't have that protocol enabled in the Git config file.
-            with self.assertRaises(GitCommandError):
-                Submodule.add(rw_repo, "new", "new", url, allow_unsafe_protocols=True)
-            assert not tmp_file.exists()
+        with tempfile.TemporaryDirectory() as tdir:
+            tmp_dir = Path(tdir)
+            tmp_file = tmp_dir / "pwn"
+            urls = [
+                f"ext::sh -c touch% {tmp_file}",
+                "fd::/foo",
+            ]
+            for url in urls:
+                # The URL will be allowed into the command, but the command will
+                # fail since we don't have that protocol enabled in the Git config file.
+                with self.assertRaises(GitCommandError):
+                    Submodule.add(rw_repo, "new", "new", url, allow_unsafe_protocols=True)
+                assert not tmp_file.exists()
 
     @with_rw_repo("HEAD")
     def test_submodule_add_unsafe_options(self, rw_repo):
-        tmp_dir = Path(tempfile.mkdtemp())
-        tmp_file = tmp_dir / "pwn"
-        unsafe_options = [
-            f"--upload-pack='touch {tmp_file}'",
-            f"-u 'touch {tmp_file}'",
-            "--config=protocol.ext.allow=always",
-            "-c protocol.ext.allow=always",
-        ]
-        for unsafe_option in unsafe_options:
-            with self.assertRaises(UnsafeOptionError):
-                Submodule.add(rw_repo, "new", "new", str(tmp_dir), clone_multi_options=[unsafe_option])
-            assert not tmp_file.exists()
+        with tempfile.TemporaryDirectory() as tdir:
+            tmp_dir = Path(tdir)
+            tmp_file = tmp_dir / "pwn"
+            unsafe_options = [
+                f"--upload-pack='touch {tmp_file}'",
+                f"-u 'touch {tmp_file}'",
+                "--config=protocol.ext.allow=always",
+                "-c protocol.ext.allow=always",
+            ]
+            for unsafe_option in unsafe_options:
+                with self.assertRaises(UnsafeOptionError):
+                    Submodule.add(rw_repo, "new", "new", str(tmp_dir), clone_multi_options=[unsafe_option])
+                assert not tmp_file.exists()
 
     @with_rw_repo("HEAD")
     def test_submodule_add_unsafe_options_allowed(self, rw_repo):
-        tmp_dir = Path(tempfile.mkdtemp())
-        tmp_file = tmp_dir / "pwn"
-        unsafe_options = [
-            f"--upload-pack='touch {tmp_file}'",
-            f"-u 'touch {tmp_file}'",
-        ]
-        for unsafe_option in unsafe_options:
-            # The options will be allowed, but the command will fail.
-            with self.assertRaises(GitCommandError):
-                Submodule.add(
-                    rw_repo, "new", "new", str(tmp_dir), clone_multi_options=[unsafe_option], allow_unsafe_options=True
-                )
-            assert not tmp_file.exists()
-
-        unsafe_options = [
-            "--config=protocol.ext.allow=always",
-            "-c protocol.ext.allow=always",
-        ]
-        for unsafe_option in unsafe_options:
-            with self.assertRaises(GitCommandError):
-                Submodule.add(
-                    rw_repo, "new", "new", str(tmp_dir), clone_multi_options=[unsafe_option], allow_unsafe_options=True
-                )
+        with tempfile.TemporaryDirectory() as tdir:
+            tmp_dir = Path(tdir)
+            tmp_file = tmp_dir / "pwn"
+            unsafe_options = [
+                f"--upload-pack='touch {tmp_file}'",
+                f"-u 'touch {tmp_file}'",
+            ]
+            for unsafe_option in unsafe_options:
+                # The options will be allowed, but the command will fail.
+                with self.assertRaises(GitCommandError):
+                    Submodule.add(
+                        rw_repo, "new", "new", str(tmp_dir), clone_multi_options=[unsafe_option], allow_unsafe_options=True
+                    )
+                assert not tmp_file.exists()
+
+            unsafe_options = [
+                "--config=protocol.ext.allow=always",
+                "-c protocol.ext.allow=always",
+            ]
+            for unsafe_option in unsafe_options:
+                with self.assertRaises(GitCommandError):
+                    Submodule.add(
+                        rw_repo, "new", "new", str(tmp_dir), clone_multi_options=[unsafe_option], allow_unsafe_options=True
+                    )
 
     @with_rw_repo("HEAD")
     def test_submodule_update_unsafe_url(self, rw_repo):
-        tmp_dir = Path(tempfile.mkdtemp())
-        tmp_file = tmp_dir / "pwn"
-        urls = [
-            f"ext::sh -c touch% {tmp_file}",
-            "fd::/foo",
-        ]
-        for url in urls:
-            submodule = Submodule(rw_repo, b"\0" * 20, name="new", path="new", url=url)
-            with self.assertRaises(UnsafeProtocolError):
-                submodule.update()
-            assert not tmp_file.exists()
+        with tempfile.TemporaryDirectory() as tdir:
+            tmp_dir = Path(tdir)
+            tmp_file = tmp_dir / "pwn"
+            urls = [
+                f"ext::sh -c touch% {tmp_file}",
+                "fd::/foo",
+            ]
+            for url in urls:
+                submodule = Submodule(rw_repo, b"\0" * 20, name="new", path="new", url=url)
+                with self.assertRaises(UnsafeProtocolError):
+                    submodule.update()
+                assert not tmp_file.exists()
 
     @with_rw_repo("HEAD")
     def test_submodule_update_unsafe_url_allowed(self, rw_repo):
-        tmp_dir = Path(tempfile.mkdtemp())
-        tmp_file = tmp_dir / "pwn"
-        urls = [
-            f"ext::sh -c touch% {tmp_file}",
-            "fd::/foo",
-        ]
-        for url in urls:
-            submodule = Submodule(rw_repo, b"\0" * 20, name="new", path="new", url=url)
-            # The URL will be allowed into the command, but the command will
-            # fail since we don't have that protocol enabled in the Git config file.
-            with self.assertRaises(GitCommandError):
-                submodule.update(allow_unsafe_protocols=True)
-            assert not tmp_file.exists()
+        with tempfile.TemporaryDirectory() as tdir:
+            tmp_dir = Path(tdir)
+            tmp_file = tmp_dir / "pwn"
+            urls = [
+                f"ext::sh -c touch% {tmp_file}",
+                "fd::/foo",
+            ]
+            for url in urls:
+                submodule = Submodule(rw_repo, b"\0" * 20, name="new", path="new", url=url)
+                # The URL will be allowed into the command, but the command will
+                # fail since we don't have that protocol enabled in the Git config file.
+                with self.assertRaises(GitCommandError):
+                    submodule.update(allow_unsafe_protocols=True)
+                assert not tmp_file.exists()
 
     @with_rw_repo("HEAD")
     def test_submodule_update_unsafe_options(self, rw_repo):
-        tmp_dir = Path(tempfile.mkdtemp())
-        tmp_file = tmp_dir / "pwn"
-        unsafe_options = [
-            f"--upload-pack='touch {tmp_file}'",
-            f"-u 'touch {tmp_file}'",
-            "--config=protocol.ext.allow=always",
-            "-c protocol.ext.allow=always",
-        ]
-        submodule = Submodule(rw_repo, b"\0" * 20, name="new", path="new", url=str(tmp_dir))
-        for unsafe_option in unsafe_options:
-            with self.assertRaises(UnsafeOptionError):
-                submodule.update(clone_multi_options=[unsafe_option])
-            assert not tmp_file.exists()
+        with tempfile.TemporaryDirectory() as tdir:
+            tmp_dir = Path(tdir)
+            tmp_file = tmp_dir / "pwn"
+            unsafe_options = [
+                f"--upload-pack='touch {tmp_file}'",
+                f"-u 'touch {tmp_file}'",
+                "--config=protocol.ext.allow=always",
+                "-c protocol.ext.allow=always",
+            ]
+            submodule = Submodule(rw_repo, b"\0" * 20, name="new", path="new", url=str(tmp_dir))
+            for unsafe_option in unsafe_options:
+                with self.assertRaises(UnsafeOptionError):
+                    submodule.update(clone_multi_options=[unsafe_option])
+                assert not tmp_file.exists()
 
     @with_rw_repo("HEAD")
     def test_submodule_update_unsafe_options_allowed(self, rw_repo):
-        tmp_dir = Path(tempfile.mkdtemp())
-        tmp_file = tmp_dir / "pwn"
-        unsafe_options = [
-            f"--upload-pack='touch {tmp_file}'",
-            f"-u 'touch {tmp_file}'",
-        ]
-        submodule = Submodule(rw_repo, b"\0" * 20, name="new", path="new", url=str(tmp_dir))
-        for unsafe_option in unsafe_options:
-            # The options will be allowed, but the command will fail.
-            with self.assertRaises(GitCommandError):
-                submodule.update(clone_multi_options=[unsafe_option], allow_unsafe_options=True)
-            assert not tmp_file.exists()
-
-        unsafe_options = [
-            "--config=protocol.ext.allow=always",
-            "-c protocol.ext.allow=always",
-        ]
-        submodule = Submodule(rw_repo, b"\0" * 20, name="new", path="new", url=str(tmp_dir))
-        for unsafe_option in unsafe_options:
-            with self.assertRaises(GitCommandError):
-                submodule.update(clone_multi_options=[unsafe_option], allow_unsafe_options=True)
+        with tempfile.TemporaryDirectory() as tdir:
+            tmp_dir = Path(tdir)
+            tmp_file = tmp_dir / "pwn"
+            unsafe_options = [
+                f"--upload-pack='touch {tmp_file}'",
+                f"-u 'touch {tmp_file}'",
+            ]
+            submodule = Submodule(rw_repo, b"\0" * 20, name="new", path="new", url=str(tmp_dir))
+            for unsafe_option in unsafe_options:
+                # The options will be allowed, but the command will fail.
+                with self.assertRaises(GitCommandError):
+                    submodule.update(clone_multi_options=[unsafe_option], allow_unsafe_options=True)
+                assert not tmp_file.exists()
+
+            unsafe_options = [
+                "--config=protocol.ext.allow=always",
+                "-c protocol.ext.allow=always",
+            ]
+            submodule = Submodule(rw_repo, b"\0" * 20, name="new", path="new", url=str(tmp_dir))
+            for unsafe_option in unsafe_options:
+                with self.assertRaises(GitCommandError):
+                    submodule.update(clone_multi_options=[unsafe_option], allow_unsafe_options=True)