Skip to content
This repository was archived by the owner on Sep 1, 2025. It is now read-only.

Commit f5d86fe

Browse files
committed
feat(build): #1159 excessive privileges
- Solve excessive privileges to temporary files - Creates a temporary file in the most secure manner possible. Signed-off-by: Robin Quintero <rohaquinlop301@gmail.com>
1 parent 8e5b6cc commit f5d86fe

1 file changed

Lines changed: 24 additions & 1 deletion

File tree

src/cli/main/cli.py

Lines changed: 24 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,7 @@
4949
import tempfile
5050
import textwrap
5151
from time import (
52+
sleep,
5253
time,
5354
)
5455
from tui import (
@@ -411,11 +412,33 @@ class Config(NamedTuple):
411412
cache: List[Dict[str, str]]
412413

413414

415+
def _get_named_temporary_file_name() -> str:
416+
attempts = 0
417+
file_name = ""
418+
success = False
419+
while attempts < 5 and not success:
420+
try:
421+
with tempfile.NamedTemporaryFile(delete=True) as file:
422+
file_name = file.name
423+
success = True
424+
except FileExistsError as error:
425+
CON.print(
426+
f"Failed to create {error.filename}, retrying in 1 second..."
427+
)
428+
attempts += 1
429+
sleep(1)
430+
431+
if not success:
432+
raise FileExistsError("Temporary file already exists.")
433+
return file_name
434+
435+
414436
def _get_config(head: str, attr_paths: str) -> Config:
415437
CON.out()
416438
CON.rule("Building project configuration")
417439
CON.out()
418-
out: str = tempfile.mktemp() # nosec
440+
441+
out: str = _get_named_temporary_file_name()
419442
code = _run(
420443
args=_nix_build(
421444
attr="config.configAsJson"

0 commit comments

Comments
 (0)