From: Miss Islington (bot) <31488909+miss-islington@users.noreply.github.com>
Date: Wed, 15 Apr 2026 00:06:33 +0000 (+0200)
Subject: [3.13] gh-137335: remove a mktemp use in multiprocessing.connection to avoid security... 
X-Git-Url: http://git.ipfire.org/index.cgi?a=commitdiff_plain;h=ba2f30eb83fc05c60cf99802dcce6ac1d9a46cf0;p=thirdparty%2FPython%2Fcpython.git

[3.13] gh-137335: remove a mktemp use in multiprocessing.connection to avoid security scanner noise (GH-148578) (#148584)

gh-137335: remove a mktemp use in multiprocessing.connection to avoid security scanner noise (GH-148578)

remove a mktemp use to avoid security scanner noise
(cherry picked from commit fd81246bd55e4fab1976a7cca3e5d42582dbdac0)

Co-authored-by: Gregory P. Smith <68491+gpshead@users.noreply.github.com>
---

diff --git a/Lib/multiprocessing/connection.py b/Lib/multiprocessing/connection.py
index efb9ea95ab46..2a0151dab802 100644
--- a/Lib/multiprocessing/connection.py
+++ b/Lib/multiprocessing/connection.py
@@ -75,7 +75,11 @@ def arbitrary_address(family):
     if family == 'AF_INET':
         return ('localhost', 0)
     elif family == 'AF_UNIX':
-        return tempfile.mktemp(prefix='sock-', dir=util.get_temp_dir())
+        # NOTE: util.get_temp_dir() is a 0o700 per-process directory. A
+        # mktemp-style ToC vs ToU concern is not important; bind() surfaces
+        # the extremely unlikely collision as EADDRINUSE.
+        return os.path.join(util.get_temp_dir(),
+                            f'sock-{os.urandom(6).hex()}')
     elif family == 'AF_PIPE':
         return (r'\\.\pipe\pyc-%d-%d-%s' %
                 (os.getpid(), next(_mmap_counter), os.urandom(8).hex()))