Re: [Tutor] Can tempfile.NamedTemporaryFile(delete=False) be used to create *permanent* uniquely named files?
On 23Oct2018 11:24, Peter Otten <__pete...@web.de> wrote:
Cameron Simpson wrote:
The doco for mktemp (do not use! use mkstemp or the
NamedTemporaryFile
classes instead!) explicitly mentions using delete=False.
Well, "permanent temporary file" does sound odd.
By the way, NamedTemporaryFile returns a proxy instead of the file itself.
In some rare cases that could be a problem.
Would mktemp() really be dangerous if you used it like this,
def new_game(directory):
for _retry in range(3):
filename = mktemp("game_", ".json", dir=directory)
try:
return open(filename, "x")
except FileExistsError:
pass
raise FileExistsError
with the "x" mode?
In terms of a race, maybe not. But in terms of security? Probably.
Consider: the issue with mktemp is that it can be switched out before
use. So:
Alice: mktemp() -> filename
Mallory: guess filename, put a symlink there pointing at a file which
doesn't exist, but which has an effect if it does. For example, in
ancient windows, an autorun.ini file. Or cooler, on UNIX, a file in
/etc/cron.d.
Alice: write to filename, not accidentally _creating_ the target of the
symlink, now writing a file somewhere unwanted.
Now, the examples above pretend that Alice has root privileges so that
Mallory affects a root run system. But for Alice, it is just as bad if
Mallory just subverts her personal account via some other pathname.
Also, there's the issue of privacy: open(), in your example, will use
the default umask, which may be more open than one wants. And so on...
Cheers,
Cameron Simpson
___
Tutor maillist - Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor
Re: [Tutor] Can tempfile.NamedTemporaryFile(delete=False) be used to create *permanent* uniquely named files?
Cameron Simpson wrote:
> On 21Oct2018 10:55, Peter Otten <__pete...@web.de> wrote:
>>boB Stepp wrote:
>>> So I am now wondering if using
>>> tempfile.NamedTemporaryFile(delete=False) would solve this problem
>>> nicely? As I am not very familiar with this library, are there any
>>> unforeseen issues I should be made aware of? Would this work equally
>>> well on all operating systems?
>>
>>I think this is cool thinking outside of the box.
>>
>>I would not have "dared" this, but now you suggest it I cannot see
>>anything wrong with your approach.
>
> The doco for mktemp (do not use! use mkstemp or the NamedTemporaryFile
> classes instead!) explicitly mentions using delete=False.
Well, "permanent temporary file" does sound odd.
By the way, NamedTemporaryFile returns a proxy instead of the file itself.
In some rare cases that could be a problem.
Would mktemp() really be dangerous if you used it like this,
def new_game(directory):
for _retry in range(3):
filename = mktemp("game_", ".json", dir=directory)
try:
return open(filename, "x")
except FileExistsError:
pass
raise FileExistsError
with the "x" mode?
___
Tutor maillist - Tutor@python.org
To unsubscribe or change subscription options:
https://mail.python.org/mailman/listinfo/tutor
Re: [Tutor] Can tempfile.NamedTemporaryFile(delete=False) be used to create *permanent* uniquely named files?
On 21.10.18 08:13, boB Stepp wrote: Use case: I want to allow a user of my Solitaire Scorekeeper program to be able to give any name he wants to each game of solitaire he wishes to record. My thought for permanent storage of each game's parameters is to use a dictionary to map the user-chosen game names to a unique json filename. This way I hope no shenanigans can occur with weird characters/non-printing characters. My initial thought was to just have a sequence of game names with incrementing numerical suffixes: game_0, game_1, ... , game_n. But this would require the program to keep track of what the next available numerical suffix is. Additionally, if a user chooses to delete a game, then there would be a gap in the numerical sequence of the game filenames. I find such a gap aesthetically displeasing and would probably go to additional efforts to reuse such deleted filenames, so there would be no such "gaps". So I am now wondering if using tempfile.NamedTemporaryFile(delete=False) would solve this problem nicely? As I am not very familiar with this library, are there any unforeseen issues I should be made aware of? Would this work equally well on all operating systems? TIA! This sounds like a good though surprising use case. The only odd thing about this is the misleading name then of the function, plus there is the (vague) possibility that the stdlib module might evolve and no longer support this undocumented (given that the first sentence in the module description reads: "This module creates temporary files and directories.") use case. I would probably address these issues and the handling of the dir parameter via a partial function like this: from functools import partial SavedGameFile = partial( tempfile.NamedTemporaryFile, dir=my_saved_games_dir ) # if you like also set the suffix here SavedGameFile.__doc__ = """\ Create and return a saved game file, ... """ This way you have a good name for the function, and you can redefine the function, if you ever want/need to move away from NamedTemporaryFile, without having to rewrite every function call. Wolfgang ___ Tutor maillist - Tutor@python.org To unsubscribe or change subscription options: https://mail.python.org/mailman/listinfo/tutor
Re: [Tutor] Can tempfile.NamedTemporaryFile(delete=False) be used to create *permanent* uniquely named files?
On 21Oct2018 10:55, Peter Otten <__pete...@web.de> wrote: boB Stepp wrote: So I am now wondering if using tempfile.NamedTemporaryFile(delete=False) would solve this problem nicely? As I am not very familiar with this library, are there any unforeseen issues I should be made aware of? Would this work equally well on all operating systems? I think this is cool thinking outside of the box. I would not have "dared" this, but now you suggest it I cannot see anything wrong with your approach. The doco for mktemp (do not use! use mkstemp or the NamedTemporaryFile classes instead!) explicitly mentions using delete=False. Cheers, Cameron Simpson ___ Tutor maillist - Tutor@python.org To unsubscribe or change subscription options: https://mail.python.org/mailman/listinfo/tutor
Re: [Tutor] Can tempfile.NamedTemporaryFile(delete=False) be used to create *permanent* uniquely named files?
boB Stepp wrote: > Use case: I want to allow a user of my Solitaire Scorekeeper program > to be able to give any name he wants to each game of solitaire he > wishes to record. My thought for permanent storage of each game's > parameters is to use a dictionary to map the user-chosen game names to > a unique json filename. This way I hope no shenanigans can occur with > weird characters/non-printing characters. > > My initial thought was to just have a sequence of game names with > incrementing numerical suffixes: game_0, game_1, ... , game_n. But > this would require the program to keep track of what the next > available numerical suffix is. Additionally, if a user chooses to > delete a game, then there would be a gap in the numerical sequence of > the game filenames. I find such a gap aesthetically displeasing and > would probably go to additional efforts to reuse such deleted > filenames, so there would be no such "gaps". > > So I am now wondering if using > tempfile.NamedTemporaryFile(delete=False) would solve this problem > nicely? As I am not very familiar with this library, are there any > unforeseen issues I should be made aware of? Would this work equally > well on all operating systems? I think this is cool thinking outside of the box. I would not have "dared" this, but now you suggest it I cannot see anything wrong with your approach. ___ Tutor maillist - Tutor@python.org To unsubscribe or change subscription options: https://mail.python.org/mailman/listinfo/tutor
Re: [Tutor] Can tempfile.NamedTemporaryFile(delete=False) be used to create *permanent* uniquely named files?
On 21Oct2018 01:13, boB Stepp wrote: Use case: I want to allow a user of my Solitaire Scorekeeper program to be able to give any name he wants to each game of solitaire he wishes to record. My thought for permanent storage of each game's parameters is to use a dictionary to map the user-chosen game names to a unique json filename. This way I hope no shenanigans can occur with weird characters/non-printing characters. My initial thought was to just have a sequence of game names with incrementing numerical suffixes: game_0, game_1, ... , game_n. But this would require the program to keep track of what the next available numerical suffix is. Additionally, if a user chooses to delete a game, then there would be a gap in the numerical sequence of the game filenames. I find such a gap aesthetically displeasing and would probably go to additional efforts to reuse such deleted filenames, so there would be no such "gaps". So I am now wondering if using tempfile.NamedTemporaryFile(delete=False) would solve this problem nicely? As I am not very familiar with this library, are there any unforeseen issues I should be made aware of? Would this work equally well on all operating systems? The doco reads that way to me. However, NamedTemporaryFile is a (nice) wrapper for tempfile.mkstemp(). Why not use that directly? Cheers, Cameron Simpson ___ Tutor maillist - Tutor@python.org To unsubscribe or change subscription options: https://mail.python.org/mailman/listinfo/tutor
Re: [Tutor] Can tempfile.NamedTemporaryFile(delete=False) be used to create *permanent* uniquely named files?
On 21/10/18 07:13, boB Stepp wrote: > My initial thought was to just have a sequence of game names with > incrementing numerical suffixes: game_0, game_1, ... , game_n. But > this would require the program to keep track of what the next > available numerical suffix is. The traditional approach to such scenarios (eg. for log files) is to append the datetime. If that is not enough granularity you can additionally append a numeric suffix that applies only during a single session(ie a global variable) and is only applied when the datetimes are identical - very rare. > tempfile.NamedTemporaryFile(delete=False) would solve this problem Can't help there, I've never used it. :-) -- Alan G Author of the Learn to Program web site http://www.alan-g.me.uk/ http://www.amazon.com/author/alan_gauld Follow my photo-blog on Flickr at: http://www.flickr.com/photos/alangauldphotos ___ Tutor maillist - Tutor@python.org To unsubscribe or change subscription options: https://mail.python.org/mailman/listinfo/tutor
Re: [Tutor] Can tempfile.NamedTemporaryFile(delete=False) be used to create *permanent* uniquely named files?
Hi Robert, Far from being an expert, my two cents on this: - As I understand it, you should at least use the 'dir' parameter to NamedTemporaryFile, otherwise your files will be created in a '/tmp/'-like directory that may be wiped clean by the OS now and then. - I seems that the only functionality you desire from tempfile is the generation of a random file name (and maybe ensuring that no collision occurs). You could use the 'random' standard library module to generate such names easily (which is about what tempfile does under the hood) import random CHARS = 'abcdefghijklmnopqrstuvw1234567890' def random_name(length): return ''.join([random.choice(CHARS) for _ in range(length)]) Cheers, Quentin Le dim. 21 oct. 2018 à 08:15, boB Stepp a écrit : > Use case: I want to allow a user of my Solitaire Scorekeeper program > to be able to give any name he wants to each game of solitaire he > wishes to record. My thought for permanent storage of each game's > parameters is to use a dictionary to map the user-chosen game names to > a unique json filename. This way I hope no shenanigans can occur with > weird characters/non-printing characters. > > My initial thought was to just have a sequence of game names with > incrementing numerical suffixes: game_0, game_1, ... , game_n. But > this would require the program to keep track of what the next > available numerical suffix is. Additionally, if a user chooses to > delete a game, then there would be a gap in the numerical sequence of > the game filenames. I find such a gap aesthetically displeasing and > would probably go to additional efforts to reuse such deleted > filenames, so there would be no such "gaps". > > So I am now wondering if using > tempfile.NamedTemporaryFile(delete=False) would solve this problem > nicely? As I am not very familiar with this library, are there any > unforeseen issues I should be made aware of? Would this work equally > well on all operating systems? > > TIA! > -- > boB > ___ > Tutor maillist - Tutor@python.org > To unsubscribe or change subscription options: > https://mail.python.org/mailman/listinfo/tutor > ___ Tutor maillist - Tutor@python.org To unsubscribe or change subscription options: https://mail.python.org/mailman/listinfo/tutor
Re: [Tutor] Can tempfile.NamedTemporaryFile(delete=False) be used to create *permanent* uniquely named files?
On Sun, Oct 21, 2018 at 1:47 AM Quentin Agren wrote: > > Hi Robert, > > Far from being an expert, my two cents on this: > > - As I understand it, you should at least use the 'dir' parameter to > NamedTemporaryFile, otherwise your files will be created in a '/tmp/'-like > directory that may be wiped clean by the OS now and then. I am planning to set both the "dir" and "suffix" parameters if I go this route and probably the "mode" parameter, too. > - I seems that the only functionality you desire from tempfile is the > generation of a random file name (and maybe ensuring that no collision > occurs). You could use the 'random' standard library module to generate such > names easily (which is about what tempfile does under the hood) It is important for me to have no name collisions however unlikely such an event might be. > import random > CHARS = 'abcdefghijklmnopqrstuvw1234567890' > def random_name(length): > return ''.join([random.choice(CHARS) for _ in range(length)]) It occurred to me to do this type of approach. But why write this myself when a standard library module may give me what I want with only one or two lines of code? When I searched online others have recommended using the uuid library to generate names. But one still has to check that it does not already exist (However unlikely.) and format the final filename. And I would have to do the same for the code snippet you supplied, adding a few additional lines of code. But thank you for your input! It may turn out that there is something undesirable that I am unaware of in the NamedTemporaryFile approach, other than what I really want is a NamedPermanentFile approach, but the standard library naming suggest otherwise! ~(:>)) boB ___ Tutor maillist - Tutor@python.org To unsubscribe or change subscription options: https://mail.python.org/mailman/listinfo/tutor
