[Personal information leak] Information leak in models_utils.deserialize_file

When deserializing files from a server that uses Content-Disposition header, model_utils (Python) creates a file in a temp folder of the client file-system with the name provided by the server. That file name could contain sensitive personal information, like the name of a patient, or a social security number, or both; and the client is responsible of deleting the files after loading into memory the bytes. If deletion fails or takes time, there is a window of time when personal information is exposed, and at the client side there is not way of govern that.

Describe the solution you'd like

First, I would suggest that by default the client don't use provided files names to create temp files. Second, I recommend to add an option for backward compatibility, because I understand that others might want current behaviour specially for dev, test.

Right now, to cope with internal security standards I am patching the deserialize_files function with:

def patched_deserialize(response_data, configuration, content_disposition=None):
    fd, path = tempfile.mkstemp(dir=configuration.temp_folder_path)
    os.close(fd)
    os.remove(path)

    if content_disposition:
        path = tempfile.NamedTemporaryFile(delete=True, mode="wb").name

    with open(path, "wb") as f:
        if isinstance(response_data, str):
            # change str to bytes so we can write it
            response_data = response_data.encode("utf-8")
        f.write(response_data)

    f = open(path, "rb")
    return f

Describe alternatives you've considered

Fork this repo, modify this mustache template as in the patched example, and release an internal package. However, I realised that this feature to prevent personal information leak is something that could benefit others and the tool.

Additional context

Probably with other languages this is also happening.

Start with modules/openapi-generator/src/main/resources/python/model_utils.mustache, especially the deserialize_file or deserialize_files logic around lines 1061-1095, and review how Content-Disposition supplies the temporary filename. Done means the default behavior no longer exposes server-provided personal information in temporary filenames, while a documented backward-compatible option preserves the existing behavior.