Skip to content

Conversation

@mhocking2020
Copy link
Contributor

This changeset removes the references to os.tempnam in some of the sample code used as a fallback when no filename is provided.
os.tempnam has been deprecated since Python 3.0 and was considered a symlink vulnerability prior to that:
https://docs.python.org/2.7/library/os.html
While the function is not actually used to generate temporary files in Nitro as intended, it still appears in SonarQube scans as a vulnerability.
Swapped to uuid to provide a non-deprecated function that provides unique file names while also not thrown as a vulnerability in SonarQube.

Test Steps:

  • Install Nitro
  • Add modules/python to Python path
  • Remove os.path.basename(fileName) from the CLI calls to force it to hit the fallback
    • Line 71 in nitf_extract.py - Last variable
    • Line 73 in test_image.py - Last variable
    • This behavior is never encountered normally if you use the CLI as it will automatically use the input filename
  • Run each and ensure you get the expected outputs
    • python nitf_extract.py {Path to Nitro}\modules\c++\nitf\unittests\sicd_50x50.nitf
      • Should produce 2 .out files that begin with a hex identifier
    • python test_image.py {Path to Nitro}\modules\c++\nitf\unittests\sicd_50x50.nitf
      • Should produce 2 .jpg files that begin with a hex identifier

@mhocking2020
Copy link
Contributor Author

mhocking2020 commented Dec 4, 2025

I can also see removing this fallback in favor of having it default to a generic "nitf_extract" / "nitf_image" base name as I do not really see why these had to be unique in the first place.

@adam-beauchamp adam-beauchamp self-assigned this Dec 17, 2025
Copy link
Contributor

@adam-beauchamp adam-beauchamp left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@adam-beauchamp adam-beauchamp merged commit 1887158 into mdaus:main Dec 17, 2025
3 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants