Terraform test directory must be local to the config directory (#33760)

internal/command/test.go

@@ -5,6 +5,7 @@ package command
 
 import (
 	"context"
+	"path/filepath"
 	"strings"
 	"time"
 
@@ -94,6 +95,18 @@ func (c *TestCommand) Run(rawArgs []string) int {
 
 	view := views.NewTest(args.ViewType, c.View)
 
+	// The specified testing directory must be a relative path, and it must
+	// point to a directory that is a descendent of the configuration directory.
+	if !filepath.IsLocal(args.TestDirectory) {
+		diags = diags.Append(tfdiags.Sourceless(
+			tfdiags.Error,
+			"Invalid testing directory",
+			"The testing directory must be a relative path pointing to a directory local to the configuration directory."))
+
+		view.Diagnostics(nil, nil, diags)
+		return 1
+	}
+
 	config, configDiags := c.loadConfigWithTests(".", args.TestDirectory)
 	diags = diags.Append(configDiags)
 	if configDiags.HasErrors() {

internal/command/test_test.go

@@ -51,6 +51,18 @@ func TestTest(t *testing.T) {
 			expected: "1 passed, 0 failed.",
 			code:     0,
 		},
+		"simple_pass_bad_test_directory": {
+			override: "simple_pass",
+			args:     []string{"-test-directory", "../tests"},
+			expected: "Invalid testing directory",
+			code:     1,
+		},
+		"simple_pass_bad_test_directory_abs": {
+			override: "simple_pass",
+			args:     []string{"-test-directory", "/home/username/config/tests"},
+			expected: "Invalid testing directory",
+			code:     1,
+		},
 		"pass_with_locals": {
 			expected: "1 passed, 0 failed.",
 			code:     0,
@@ -206,7 +218,7 @@ func TestTest(t *testing.T) {
 				t.Errorf("expected status code %d but got %d", tc.code, code)
 			}
 
-			if !strings.Contains(output.Stdout(), tc.expected) {
+			if !strings.Contains(output.All(), tc.expected) {
 				t.Errorf("output didn't contain expected string:\n\n%s", output.All())
 			}