Skip to content

Harden Python temporary path handling - #1387

Draft
fvaloppi-nv wants to merge 1 commit into
mainfrom
codex/harden-public-temp-paths
Draft

fvaloppi-nv wants to merge 1 commit into
mainfrom
codex/harden-public-temp-paths

Conversation

@fvaloppi-nv

@fvaloppi-nv fvaloppi-nv commented Oct 28, 2026 •

Copy link
Copy Markdown
Contributor

Summary

  • make example parameter persistence opt-in instead of using predictable shared temporary files
  • create Python logging directories with owner-only permissions
  • reject symlinked or replaceable POSIX logging directory chains
  • cover the directory policy with focused Python tests

Scope and compatibility

  • this PR contains the Python-only half of the change
  • explicitly configured persistence and logging paths remain supported
  • unsafe logging paths fail closed instead of silently writing through a shared path
  • non-POSIX directory creation retains its previous behavior

Validation

  • SKIP=check-copyright-year pre-commit run --all-files
  • Ruff format and lint on all touched Python files
  • 33 focused logging configuration tests

Companion change

#1388 contains the C++/HPP-only half. Each PR is independently safe, but merging both keeps the Python and C++ logging implementations aligned.

@coderabbitai

coderabbitai Bot commented Oct 28, 2026

Copy link
Copy Markdown
Contributor

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

  • Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true
  • Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Comment @coderabbitai help to get the list of available commands.

# mkdir applies the restrictive mode atomically; chmod after a
# recursive mkdir would leave a world-writable race window.
component.mkdir(mode=0o700)
except FileExistsError:
Signed-off-by: fvaloppi-nv <fvaloppi@nvidia.com>
@fvaloppi-nv
fvaloppi-nv force-pushed the codex/harden-public-temp-paths branch from db97f0e to ed8b4bf Compare October 28, 2026 21:10
@fvaloppi-nv fvaloppi-nv changed the title Harden temporary path handling Harden Python temporary path handling Oct 28, 2026

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants