B306.md

Pattern: Use of insecure mktemp() function

Issue: -

Description

Use of this function may introduce a security hole in your program. By the time you get around to doing anything with the file name it returns, someone else may have beaten you to the punch. Use mkstemp() instead or replace with NamedTemporaryFile(), passing it the delete=False parameter.

Example of insecure code:

tempfile.mktemp('foo')

Example of secure code:

tempfile.mkstemp('foo')

Further Reading

• The Python Standard Library - mktemp
• Bandit - B306: mktemp_q