search

celery / billiard

Multiprocessing Pool Extensions
Other
419 stars 252 forks source link

Replacing `mktemp` usage in multiple files #393

Closed fazledyn-or closed 1 year ago

fazledyn-or commented 1 year ago

Hi,

I'm a Software Security Engineer at @OpenRefactory-Inc. We're working with the OpenSSF on Project Alpha-Omega.

While triaging your project, we noticed three usages of mktemp method of the tempfile library. I have some observations regarding them, please feel free to comment-

  1. heap.py In this file, if the Python version is 2.0, the mktemp method is used. However, as of Python 2.7.18- the mkstemp method exists in the tempfile library. As a result, the mktemp usage can be replaced by mkstemp, like it is done in for Python 3. In that case, I can create a PR for you to merge.

  2. connection.py

  3. connection.py In these two cases, what I understand is that the mktemp method is being used to generate a unique, temporary file that can used as AF_UNIX socket or AF_PIPE object to communicate between two processes. Is my assumption correct? If so, won't using mkstemp (provided that your close the FD) or NamedTemporaryFile be a better solution?

Please let me know your opinion.

Thanks

auvipy commented 1 year ago

the project is python 3.8+ only now so we can consider updating the code base. another thing is we have to sync/upgrade the codes to align with python multiprocessing library, but that is a big scope and need lots of time. so I would be happy to review small PR's to gradually improve it. you can come with a draft PR and ask for review as you shared in the issue.

fazledyn-or commented 1 year ago

Great! Please have a look at this: https://github.com/celery/billiard/pull/394