googleapis / googleapis/python-aiplatform

Replace `mktemp` method with `NamedTemporaryFile`

Aperta
#2,562 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
api: vertex-ai
Lingua principale
Python
Stelle
905
Fork
465
Merge medio
1g 13h
PR unite (30g)
44

Descrizione

## Overview
In file: `pipeline_jobs.py`, there is a method that creates a temporary file using an unsafe API mktemp. The use of this method is discouraged in the Python documentation. iCR suggested that a temporary file should be created using NamedTemporaryFile or mkstemp which is a safe API. iCR replaced the usage of mktemp with mkstemp. Read more about tempfile's deprecated functions [here](https://docs.python.org/3/library/tempfile.html#deprecated-functions-and-variables).

### Solution
Replace the `mktemp` method with a safe one- `mkstemp` in file: [pipeline_jobs.py](https://github.com/googleapis/python-aiplatform/blob/main/google/cloud/aiplatform/pipeline_jobs.py#L1070)

```diff
--- a/google/cloud/aiplatform/pipeline_jobs.py
+++ b/google/cloud/aiplatform/pipeline_jobs.py
@@ -1067,7 +1067,7 @@ class PipelineJob(
job_id = job_id or re.sub(
r"[^-a-z0-9]", "-", automatic_display_name.lower()
).strip("-")
- pipeline_file = tempfile.mktemp(suffix=".json")
+ pipeline_file = tempfile.NamedTemporaryFile(suffix=".json").name
compiler_v2.Compiler().compile(
pipeline_func=pipeline_func,
pipeline_name=context_name,
```

### Sponsorship and Support:

This work is done by the security researchers from OpenRefactory and is supported by the [Open Source Security Foundation (OpenSSF)](https://openssf.org/): [Project Alpha-Omega](https://alpha-omega.dev/). Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code - and get them fixed – to improve global software supply chain security.

The bug is found by running the Intelligent Code Repair (iCR) tool by OpenRefactory and then manually triaging the results.

Guida per i contributori

Apri la guida per i contributori

Valutazione

Questa issue non è ancora stata valutata.

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.