gh-127371 Avoid unbounded growth SpooledTempfile.writelines

Lib/tempfile.py

@@ -848,10 +848,17 @@ def write(self, s):
         return rv
 
     def writelines(self, iterable):
-        file = self._file
-        rv = file.writelines(iterable)
-        self._check(file)
-        return rv
+        if self._max_size == 0 or self._rolled:
+            return self._file.writelines(iterable)
+
+        it = iter(iterable)
+
+        for line in it:
+            self.write(line)
+            if self._rolled:
+                break
+
+        return self._file.writelines(it)
 
     def detach(self):
         return self._file.detach()

Lib/test/test_tempfile.py

@@ -1288,6 +1288,18 @@ def test_writelines(self):
         buf = f.read()
         self.assertEqual(buf, b'xyz')
 
+    def test_writelines_rollover(self):
+        # Verify writelines rolls over before exhausting the iterator
+        f = self.do_create(max_size=2)
+
+        def it():
+            yield b'xy'
+            self.assertFalse(f._rolled)
+            yield b'z'
+            self.assertTrue(f._rolled)
+
+        f.writelines(it())
+
     def test_writelines_sequential(self):
         # A SpooledTemporaryFile should hold exactly max_size bytes, and roll
         # over afterward

Misc/NEWS.d/next/Security/2024-11-28-20-29-21.gh-issue-127371.PeEhUd.rst

@@ -0,0 +1 @@
+Avoid unbounded buffering for :class:`tempfile.SpooledTemporaryFile`. Previously, when the :meth:`tempfile.SpooledTemporaryFile.writelines` method was called, disk-spillover was only checked after the lines iterator had been exhausted. This is now done while writing instead.