[all-commits] [llvm/llvm-project] bcb459: Replace Python's deprecated tempfile.mktemp() with...

[Zachary Henkel via All-commits]

  Branch: refs/heads/main
  Home:   https://github.com/llvm/llvm-project
  Commit: bcb459015e12fb03e4ae3d56393883b2974f96fb
      https://github.com/llvm/llvm-project/commit/bcb459015e12fb03e4ae3d56393883b2974f96fb
  Author: Zachary Henkel <zachary.henkel at gmail.com>
  Date:   2026-07-17 (Fri, 17 Jul 2026)

  Changed paths:
    M compiler-rt/test/sanitizer_common/android_commands/android_common.py
    M lldb/examples/python/delta.py
    M lldb/examples/python/gdbremote.py

  Log Message:
  -----------
  Replace Python's deprecated tempfile.mktemp() with secure temp APIs (#210123)

Python's tempfile.mktemp() is deprecated and insecure: it returns a path
without creating the file, leaving a TOCTOU/symlink window before the
file is opened. Replace every use, choosing the temp API by lifetime:

- compiler-rt android_common.py adb(): tempfile.TemporaryFile
(anonymous, auto-deleted), read back via seek(0); drops manual
close()/unlink().
- compiler-rt android_common.py pull_from_device():
tempfile.TemporaryDirectory so "adb pull" writes into a private,
auto-cleaned directory.
- lldb examples delta.py / gdbremote.py start_gdb_log():
tempfile.NamedTemporaryFile(delete=False); the log must outlive the call
for a later stop_gdb_log, so it is intentionally not auto-deleted.

Reported by internal static analysis and contributed upstream for the
benefit of the wider community.

Assisted-by: GitHub Copilot CLI (Claude Opus 4.8)

I do not have commit access and will need someone to submit on my
behalf.



To unsubscribe from these emails, change your notification settings at https://github.com/llvm/llvm-project/settings/notifications