MNT Raise ValueError if local_filename is not a plain filename in sklearn.datasets.fetch_file (scikit-learn#34815)

Author: DeaMariaLeon

doc/whats_new/upcoming_changes/sklearn.datasets/34815.fix.rst

@@ -0,0 +1,3 @@
+- :func:`datasets.fetch_file` now raises a `ValueError` when `local_filename`
+  is a path instead of a plain filename.
+  By :user:`Dea María Léon <DeaMariaLeon>`.

sklearn/datasets/_base.py

@@ -1605,8 +1605,9 @@ def fetch_file(
         scikit-learn data home folder.
 
     local_filename : str, default=None
-        Name of the file to save. If None, the filename is inferred from the
-        URL.
+        Name of the file to save. It must be a plain filename. A value holding
+        a directory separator or a relative reference such as `".."`, raises
+        `ValueError`. If None, the filename is inferred from the URL.
 
     sha256 : str, default=None
         SHA256 checksum of the file. If None, no checksum is verified.
@@ -1626,6 +1627,15 @@ def fetch_file(
 
     if local_filename is None:
         local_filename = filename_from_url
+    elif Path(local_filename).name != local_filename or local_filename in (
+        "",
+        "..",
+    ):
+        raise ValueError(
+            "`local_filename` should be a filename, not a path, got"
+            f" {local_filename!r}. Use the `folder` argument to control the"
+            " output folder."
+        )
 
     if folder is None:
         folder = Path(get_data_home()) / folder_from_url

sklearn/datasets/tests/test_base.py

@@ -657,3 +657,71 @@ def test_fetch_file_with_sha256(monkeypatch, tmpdir):
                 folder=client_side,
                 sha256=non_matching_sha256,
             )
+
+
+@pytest.mark.parametrize(
+    "local_filename",
+    [
+        "../escaped.jsonl",
+        "subfolder/data.jsonl",
+        "/absolute/data.jsonl",
+        "subfolder/",
+        "/absolute/dir/",
+        "../",
+        "./",
+        "..",
+        ".",
+        "",
+    ],
+)
+def test_fetch_file_rejects_path_as_local_filename(monkeypatch, tmpdir, local_filename):
+    # Non-regression test: a path-like `local_filename` must be rejected instead
+    # of silently writing outside of `folder`.
+    client_side = Path(tmpdir.mkdir("client_side"))
+
+    urlretrieve_mock = Mock()
+    monkeypatch.setattr("sklearn.datasets._base.urlretrieve", urlretrieve_mock)
+
+    expected_error_msg = re.escape(
+        "`local_filename` should be a filename, not a path, got"
+        f" {local_filename!r}. Use the `folder` argument to control the"
+        " output folder."
+    )
+    with pytest.raises(ValueError, match=expected_error_msg):
+        fetch_file(
+            "https://example.com/data.jsonl",
+            folder=client_side,
+            local_filename=local_filename,
+        )
+
+    # The check happens before any download and nothing is written to disk.
+    assert urlretrieve_mock.call_count == 0
+    assert list(Path(tmpdir).rglob("*")) == [client_side]
+
+
+@pytest.mark.parametrize(
+    "local_filename",
+    [
+        "renamed.jsonl",
+        ".hidden.jsonl",
+        "data..jsonl",
+    ],
+)
+def test_fetch_file_accepts_plain_local_filename(monkeypatch, tmpdir, local_filename):
+    server_side = tmpdir.mkdir("server_side")
+    server_data = '{"a": 1, "b": 2}\n'
+    Path(server_side / "data.jsonl").write_text(server_data, encoding="utf-8")
+
+    client_side = Path(tmpdir.mkdir("client_side"))
+
+    monkeypatch.setattr(
+        "sklearn.datasets._base.urlretrieve", _mock_urlretrieve(server_side)
+    )
+
+    fetched_file_path = fetch_file(
+        "https://example.com/data.jsonl",
+        folder=client_side,
+        local_filename=local_filename,
+    )
+    assert fetched_file_path == client_side / local_filename
+    assert fetched_file_path.read_text(encoding="utf-8") == server_data