googleapis / googleapis/python-aiplatform

Replace `mktemp` method with `NamedTemporaryFile`

未关闭
#2,562 0 条评论 0 个 reaction 已指派 0 人 在 GitHub 查看
api: vertex-ai
主要语言
Python
星标
905
派生
465
平均合并
1 天 13 小时
30 天内合并 PR
44

描述

## Overview
In file: `pipeline_jobs.py`, there is a method that creates a temporary file using an unsafe API mktemp. The use of this method is discouraged in the Python documentation. iCR suggested that a temporary file should be created using NamedTemporaryFile or mkstemp which is a safe API. iCR replaced the usage of mktemp with mkstemp. Read more about tempfile's deprecated functions [here](https://docs.python.org/3/library/tempfile.html#deprecated-functions-and-variables).

### Solution
Replace the `mktemp` method with a safe one- `mkstemp` in file: [pipeline_jobs.py](https://github.com/googleapis/python-aiplatform/blob/main/google/cloud/aiplatform/pipeline_jobs.py#L1070)

```diff
--- a/google/cloud/aiplatform/pipeline_jobs.py
+++ b/google/cloud/aiplatform/pipeline_jobs.py
@@ -1067,7 +1067,7 @@ class PipelineJob(
job_id = job_id or re.sub(
r"[^-a-z0-9]", "-", automatic_display_name.lower()
).strip("-")
- pipeline_file = tempfile.mktemp(suffix=".json")
+ pipeline_file = tempfile.NamedTemporaryFile(suffix=".json").name
compiler_v2.Compiler().compile(
pipeline_func=pipeline_func,
pipeline_name=context_name,
```

### Sponsorship and Support:

This work is done by the security researchers from OpenRefactory and is supported by the [Open Source Security Foundation (OpenSSF)](https://openssf.org/): [Project Alpha-Omega](https://alpha-omega.dev/). Alpha-Omega is a project partnering with open source software project maintainers to systematically find new, as-yet-undiscovered vulnerabilities in open source code - and get them fixed – to improve global software supply chain security.

The bug is found by running the Intelligent Code Repair (iCR) tool by OpenRefactory and then manually triaging the results.

贡献指南

打开贡献指南

调研方向

在 PipelineJob 中打开 google/cloud/aiplatform/pipeline_jobs.py 的第 1070 行附近,检查编译前如何创建临时 pipeline 文件。确认已将已弃用的 tempfile.mktemp 调用替换为 issue 中描述的安全 API,然后运行覆盖 pipeline_jobs.py 的仓库测试,并验证 pipeline 编译仍然正常工作。

由索引模型根据 Issue 内容生成。

评估

技术栈
python
领域
backend
Issue 类型
缺陷
难度
1/5
预计耗时
1 小时以内
活跃度
停滞
描述清晰度
描述清楚
新手友好度
58/100

把新 issue 发到你的邮箱

精选适合新手参与的 GitHub issue 摘要。