googleapis / googleapis/python-aiplatform
Replace `mktemp` method with `NamedTemporaryFile`
- 主要语言
- Python
- 星标
- 905
- 派生
- 465
- 平均合并
- 1 天 13 小时
- 30 天内合并 PR
- 44
描述
## Overview
In file: `pipeline_jobs.py`, there is a method that creates a temporary file using an unsafe API mktemp. The use of this method is discouraged in the Python documentation. iCR suggested that a temporary file should be created using NamedTemporaryFile or mkstemp which is a safe API. iCR replaced the usage of mktemp with mkstemp. Read more about tempfile's deprecated functions [here](https://docs.python.org/3/library/tempfile.html#deprecated-functions-and-variables).
### Solution
Replace the `mktemp` method with a safe one- `mkstemp` in file: [pipeline_jobs.py](https://github.com/googleapis/python-aiplatform/blob/main/google/cloud/aiplatform/pipeline_jobs.py#L1070)
```diff
--- a/google/cloud/aiplatform/pipeline_jobs.py
+++ b/google/cloud/aiplatform/pipeline_jobs.py
@@ -1067,7 +1067,7 @@ class PipelineJob(
job_id = job_id or re.sub(
r"[^-a-z0-9]", "-", automatic_display_name.lower()
).strip("-")
- pipeline_file = tempfile.mktemp(suffix=".json")
+ pipeline_file = tempfile.NamedTemporaryFile(suffix=".json").name
compiler_v2.Compiler().compile(
pipeline_func=pipeline_func,
pipeline_name=context_name,
```
### Sponsorship and Support:
This work is done by the security researchers from OpenRefactory and is supported by the [Open Source Security Foundation (OpenSSF)](https://openssf.org/): [Project Alpha-Omega](https://alpha-omega.dev/). Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code - and get them fixed – to improve global software supply chain security.
The bug is found by running the Intelligent Code Repair (iCR) tool by OpenRefactory and then manually triaging the results.
贡献指南
调研方向
在 PipelineJob 中打开 google/cloud/aiplatform/pipeline_jobs.py 的第 1070 行附近,检查编译前如何创建临时 pipeline 文件。确认已将已弃用的 tempfile.mktemp 调用替换为 issue 中描述的安全 API,然后运行覆盖 pipeline_jobs.py 的仓库测试,并验证 pipeline 编译仍然正常工作。
由索引模型根据 Issue 内容生成。
评估
- 技术栈
- python
- 领域
- backend
- Issue 类型
- 缺陷
- 难度
- 1/5
- 预计耗时
- 1 小时以内
- 活跃度
- 停滞
- 描述清晰度
- 描述清楚
- 新手友好度
- 58/100