googleapis / googleapis/python-aiplatform
Replace `mktemp` method with `NamedTemporaryFile`
- Dominant language
- Python
- Stars
- 905
- Forks
- 465
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 44
Description
## Overview
In file: `pipeline_jobs.py`, there is a method that creates a temporary file using an unsafe API mktemp. The use of this method is discouraged in the Python documentation. iCR suggested that a temporary file should be created using NamedTemporaryFile or mkstemp which is a safe API. iCR replaced the usage of mktemp with mkstemp. Read more about tempfile's deprecated functions [here](https://docs.python.org/3/library/tempfile.html#deprecated-functions-and-variables).
### Solution
Replace the `mktemp` method with a safe one- `mkstemp` in file: [pipeline_jobs.py](https://github.com/googleapis/python-aiplatform/blob/main/google/cloud/aiplatform/pipeline_jobs.py#L1070)
```diff
--- a/google/cloud/aiplatform/pipeline_jobs.py
+++ b/google/cloud/aiplatform/pipeline_jobs.py
@@ -1067,7 +1067,7 @@ class PipelineJob(
job_id = job_id or re.sub(
r"[^-a-z0-9]", "-", automatic_display_name.lower()
).strip("-")
- pipeline_file = tempfile.mktemp(suffix=".json")
+ pipeline_file = tempfile.NamedTemporaryFile(suffix=".json").name
compiler_v2.Compiler().compile(
pipeline_func=pipeline_func,
pipeline_name=context_name,
```
### Sponsorship and Support:
This work is done by the security researchers from OpenRefactory and is supported by the [Open Source Security Foundation (OpenSSF)](https://openssf.org/): [Project Alpha-Omega](https://alpha-omega.dev/). Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code - and get them fixed – to improve global software supply chain security.
The bug is found by running the Intelligent Code Repair (iCR) tool by OpenRefactory and then manually triaging the results.
Contributor guide
Research direction
Open google/cloud/aiplatform/pipeline_jobs.py around line 1070 in PipelineJob and inspect how the temporary pipeline file is created before compilation. Confirm the deprecated tempfile.mktemp call is replaced with the safe API described in the issue, then run the repository's tests covering pipeline_jobs.py and verify pipeline compilation still works.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 58/100