diff --git a/Lib/asyncio/windows_utils.py b/Lib/asyncio/windows_utils.py index ef277fac3e291c..e5fbcc475da039 100644 --- a/Lib/asyncio/windows_utils.py +++ b/Lib/asyncio/windows_utils.py @@ -12,6 +12,7 @@ import subprocess import tempfile import warnings +import uuid __all__ = 'pipe', 'Popen', 'PIPE', 'PipeHandle' @@ -31,9 +32,8 @@ def pipe(*, duplex=False, overlapped=(True, True), bufsize=BUFSIZE): """Like os.pipe() but with overlapped support and using handles not fds.""" - address = tempfile.mktemp( - prefix=r'\\.\pipe\python-pipe-{:d}-{:d}-'.format( - os.getpid(), next(_mmap_counter))) + pipename = f'python-pipe-{os.getpid()}-{uuid.uuid4().hex}' + address = fr'\\.\pipe\{pipename}' if duplex: openmode = _winapi.PIPE_ACCESS_DUPLEX diff --git a/Misc/NEWS.d/next/Library/2025-08-04-00-25-48.gh-issue-137335.yRgZib.rst b/Misc/NEWS.d/next/Library/2025-08-04-00-25-48.gh-issue-137335.yRgZib.rst new file mode 100644 index 00000000000000..96be760983ae3b --- /dev/null +++ b/Misc/NEWS.d/next/Library/2025-08-04-00-25-48.gh-issue-137335.yRgZib.rst @@ -0,0 +1,13 @@ +matemp() function is unsafe,so I use safety function. +bandit tool: +``` +Issue: [B306:blacklist] Use of insecure and deprecated function (mktemp). +Severity: Medium Confidence: High +CWE: CWE-377 (https://cwe.mitre.org/data/definitions/377.html) +More Info: https://bandit.readthedocs.io/en/1.8.6/blacklists/blacklist_calls.html#b306-mktemp-q +Location: C:\Users\Administrator\Desktop\cpython\lib\asyncio\windows_utils.py:34:14 +33 """Like os.pipe() but with overlapped support and using handles not fds.""" +34 address = tempfile.mktemp( +35 prefix=r'\.\pipe\python-pipe-{:d}-{:d}-'.format( +36 os.getpid(), next(_mmap_counter))) +```