From a2d9d9832a1607bcb5ae2b0ca824ea88dae60464 Mon Sep 17 00:00:00 2001 From: Patrick Buckley Date: Thu, 9 Jul 2026 23:42:03 -0700 Subject: [PATCH] test(bash): use tmp_path fixture instead of tempfile.mktemp CodeQL flagged tempfile.mktemp as an insecure temporary file and Copilot flagged the same call as race-prone (the path is not reserved). Use the pytest tmp_path fixture, which reserves a unique per-test directory and is cleaned up automatically. (cherry picked from commit bec757a96b56f9c9813df1b0d5015d0ead27fbd7) --- tests/test_bash_tool_background_hang.py | 7 ++----- 1 file changed, 2 insertions(+), 5 deletions(-) diff --git a/tests/test_bash_tool_background_hang.py b/tests/test_bash_tool_background_hang.py index bb592f2d..901ecb91 100644 --- a/tests/test_bash_tool_background_hang.py +++ b/tests/test_bash_tool_background_hang.py @@ -12,7 +12,6 @@ the call always returns and never leaks the background child. import contextlib import os import signal -import tempfile import threading import time @@ -48,14 +47,14 @@ def _run_in_thread(fn, timeout): return (not t.is_alive()), box.get("result") -def test_backgrounded_child_does_not_hang_and_is_reaped(): +def test_backgrounded_child_does_not_hang_and_is_reaped(tmp_path): """Foreground exits immediately but leaves ``sleep 60 &`` holding the pipe. Old behaviour: infinite hang (EOF never arrives, watchdog bails once the tracked bash exits). New behaviour: returns promptly and the background child is reaped by the session-group kill. """ - pidfile = tempfile.mktemp(suffix=".pid") + pidfile = str(tmp_path / "bg.pid") # A generous tool_timeout proves the return comes from foreground-exit, not # from the deadline firing. session = make_session(tool_timeout=30) @@ -82,8 +81,6 @@ def test_backgrounded_child_does_not_hang_and_is_reaped(): finally: if bg_pid is not None: _kill_pid(bg_pid) - if os.path.exists(pidfile): - os.unlink(pidfile) def test_timeout_still_fires_with_backgrounded_child():