googleapis / googleapis/python-aiplatform

Replace `mktemp` method with `NamedTemporaryFile`

Abierto
#2,562 0 comentarios 0 reacciones 0 asignados Ver en GitHub
api: vertex-ai
Lenguaje dominante
Python
Estrellas
905
Forks
465
Merge medio
1 d 13 h
PR fusionados (30 d)
44

Descripción

## Overview
In file: `pipeline_jobs.py`, there is a method that creates a temporary file using an unsafe API mktemp. The use of this method is discouraged in the Python documentation. iCR suggested that a temporary file should be created using NamedTemporaryFile or mkstemp which is a safe API. iCR replaced the usage of mktemp with mkstemp. Read more about tempfile's deprecated functions [here](https://docs.python.org/3/library/tempfile.html#deprecated-functions-and-variables).

### Solution
Replace the `mktemp` method with a safe one- `mkstemp` in file: [pipeline_jobs.py](https://github.com/googleapis/python-aiplatform/blob/main/google/cloud/aiplatform/pipeline_jobs.py#L1070)

```diff
--- a/google/cloud/aiplatform/pipeline_jobs.py
+++ b/google/cloud/aiplatform/pipeline_jobs.py
@@ -1067,7 +1067,7 @@ class PipelineJob(
job_id = job_id or re.sub(
r"[^-a-z0-9]", "-", automatic_display_name.lower()
).strip("-")
- pipeline_file = tempfile.mktemp(suffix=".json")
+ pipeline_file = tempfile.NamedTemporaryFile(suffix=".json").name
compiler_v2.Compiler().compile(
pipeline_func=pipeline_func,
pipeline_name=context_name,
```

### Sponsorship and Support:

This work is done by the security researchers from OpenRefactory and is supported by the [Open Source Security Foundation (OpenSSF)](https://openssf.org/): [Project Alpha-Omega](https://alpha-omega.dev/). Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code - and get them fixed – to improve global software supply chain security.

The bug is found by running the Intelligent Code Repair (iCR) tool by OpenRefactory and then manually triaging the results.

Guía de contribución

Abrir la guía de contribución

Evaluación

Este issue todavía no se ha evaluado.

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.