Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

CVE: Apply patched tempfile module to the affected test #3155

Closed
wants to merge 1 commit into from

Conversation

SmartManoj
Copy link
Contributor

@SmartManoj SmartManoj commented Jul 28, 2024

What is the problem that this fixes or functionality that this introduces? Does it fix any open issues?

Solves the following one of the two errors from #3128

ERROR tests/unit/test_runtime.py::test_multiline_command_loop[EventStreamRuntime] - PermissionError: [Errno 1] Operation not permitted: '/tmp/tmpr4ejc4xo/_modules'


Give a summary of what the PR does, explaining any non-trivial design decisions

Applied the patch from python/cpython#91133 (comment)


Other references

CVE-2023-6597 Detail

@SmartManoj SmartManoj changed the title Patch tempfile module CVE: Patch tempfile module Jul 28, 2024
@neubig
Copy link
Contributor

neubig commented Jul 28, 2024

I would prefer not to globally patch tempfile like this, as it may cause unexpected consequences in the future. Instead:

  1. a patch to fix the individual failing tests within OpenDevin
  2. a PR to the upstream tempfile library to fix the issue

would both be welcome!

@neubig neubig closed this Jul 28, 2024
@SmartManoj SmartManoj changed the title CVE: Patch tempfile module CVE: Apply patched tempfile module to the affected test Jul 28, 2024
@SmartManoj
Copy link
Contributor Author

  1. a patch to fix the individual failing tests within OpenDevin

SmartManoj@1560bea will do that.

Could you reopen now?

@neubig
Copy link
Contributor

neubig commented Jul 28, 2024

Please open a new PR, thanks!

@SmartManoj
Copy link
Contributor Author

SmartManoj commented Jul 28, 2024

No, that's not a good practice.

  • Preservation of Context and History: Reopening a PR retains all the discussions, comments, and historical context, which can be valuable for understanding the changes and the rationale behind them​

  • Avoiding Redundancy: Opening a new PR can result in duplication of effort, as previous discussions and reviews would not be carried over. This can lead to confusion and additional work to reiterate previous points​

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants