DUO121: Why is tempfile.mkstemp (with "s") being avoided? about dlint

[mschwager]

Hi there!

The tempfile.mktemp function should be avoided because it can introduce race conditions. However, the similarly named tempfile.mkstemp function is okay. The Correct code section above is using the approach recommended by the Python documentation.

Are you seeing a false positive where Dlint is detecting mkstemp as well? It should only be detecting the function without the "s".

[hartwork]

The tempfile.mktemp function should be avoided because it can introduce race conditions.

Agreed, yes!

However, the similarly named tempfile.mkstemp function is okay.

👍

The Correct code section above is using the approach recommended by the Python documentation.

I think you refer to this block at https://docs.python.org/3.8/library/tempfile.html#deprecated-functions-and-variables:

>>> f = NamedTemporaryFile(delete=False)
>>> f.name
'/tmp/tmptjujjt'
>>> f.write(b"Hello World!\n")
13
>>> f.close()
>>> os.unlink(f.name)
>>> os.path.exists(f.name)
False

I consider their code to be demo code rather than an actual recommendation.
My understanding is that when you need to work with a filename, there are two cases:

a) The file is so short-lived that use of a context manager like — this is — fine:

with tempfile.NamedTemporaryFile() as f:
    pass  # work with f.file.fileno() and/or f.name here
# f.name deleted now

b) The file lives longer and regular use of a context manager is not an option:

fd, temp_filename = tempfile.mkstemp()                                                                                                                              
os.close(fd)                                                                                                                                                   
# do as much or little with the temp file here as needed
os.remove(filename)

If you want to keep using NamedTemporaryFile(delete=False) for the example in the docs I would suggest to change current…

import tempfile

fd = tempfile.NamedTemporaryFile(delete=False)
temp_filename = fd.name

…to…

import os, tempfile

f = tempfile.NamedTemporaryFile(delete=False)
# .. do work with f.name here ..
os.remove(f.name)

to be more complete and use f (file) rather than mis-leading fd (file descriptor) which is a plain integer most of the time.

What do you think?

Are you seeing a false positive where Dlint is detecting mkstemp as well? It should only be detecting the function without the "s".

I have no report like that, no.

[mschwager]

Thanks for all these descriptive examples!

Regarding short-lived vs. long-lived files, I think the easiest way to cover all these cases is to avoid prescriptive docs for all close and remove scenarios (and context managers). These examples are just trying to show minimal snippets of roughly equivalent code and not fully production-ready code.

Good call with fd vs. f. That recommendation is also consistent with what the Python docs use. I'd be happy to accept a PR or make that change if that works for you 👍

[hartwork]

I see your point about close and remove. I'm curious what you think of the approach taken with #22.