From ba2f30eb83fc05c60cf99802dcce6ac1d9a46cf0 Mon Sep 17 00:00:00 2001 From: "Miss Islington (bot)" <31488909+miss-islington@users.noreply.github.com> Date: Wed, 15 Apr 2026 02:06:33 +0200 Subject: [PATCH] [3.13] gh-137335: remove a mktemp use in multiprocessing.connection to avoid security scanner noise (GH-148578) (#148584) gh-137335: remove a mktemp use in multiprocessing.connection to avoid security scanner noise (GH-148578) remove a mktemp use to avoid security scanner noise (cherry picked from commit fd81246bd55e4fab1976a7cca3e5d42582dbdac0) Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com> --- Lib/multiprocessing/connection.py | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Lib/multiprocessing/connection.py b/Lib/multiprocessing/connection.py index efb9ea95ab4..2a0151dab80 100644 --- a/Lib/multiprocessing/connection.py +++ b/Lib/multiprocessing/connection.py @@ -75,7 +75,11 @@ def arbitrary_address(family): if family == 'AF_INET': return ('localhost', 0) elif family == 'AF_UNIX': - return tempfile.mktemp(prefix='sock-', dir=util.get_temp_dir()) + # NOTE: util.get_temp_dir() is a 0o700 per-process directory. A + # mktemp-style ToC vs ToU concern is not important; bind() surfaces + # the extremely unlikely collision as EADDRINUSE. + return os.path.join(util.get_temp_dir(), + f'sock-{os.urandom(6).hex()}') elif family == 'AF_PIPE': return (r'\\.\pipe\pyc-%d-%d-%s' % (os.getpid(), next(_mmap_counter), os.urandom(8).hex()))