From 9f1188d71194975d618154566b7a7ee32f051503 Mon Sep 17 00:00:00 2001
From: maziggy <mz@v8w.de>
Date: Mon, 11 May 2026 13:15:30 +0200
Subject: [PATCH] =?UTF-8?q?=20=20Tool:=20Bandit=20B108=20=20=20Severity:?=
 =?UTF-8?q?=20Warning=20=C3=974=20=20=20Issue:=20"Probable=20insecure=20us?=
 =?UTF-8?q?age=20of=20temp=20file/directory"=20=E2=80=94=20/tmp/<filename>?=
 =?UTF-8?q?=20literals=20used=20as=20synthetic=20DB=20field=20values=20in?=
 =?UTF-8?q?=20two=20integration=20tests=20=20=20Status:=20Fixed=20=20=20?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=20=20=20Tool:=20C?=
 =?UTF-8?q?odeQL=20Python=20/=20JS=20=20=20Severity:=20Pending=20=20=20Iss?=
 =?UTF-8?q?ue:=20Still=20running=20on=20the=20head=20SHA=20=20=20Status:?=
 =?UTF-8?q?=20=E2=80=94=20=20=20=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=20=20=20Tool:=20Trivy=20container=20scan=20=20=20Seve?=
 =?UTF-8?q?rity:=20Pending=20=20=20Issue:=20Still=20running=20=20=20Status?=
 =?UTF-8?q?:=20=E2=80=94=20=20=20=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80=E2=94=80?=
 =?UTF-8?q?=E2=94=80=20=20=20Tool:=20Bandit=20(Python=20Security=20Analysi?=
 =?UTF-8?q?s)=20=20=20Severity:=20Pass=20=20=20Issue:=20The=20separate=20B?=
 =?UTF-8?q?andit=20run=20on=20the=20changes=20already=20passes=20=20=20Sta?=
 =?UTF-8?q?tus:=20=E2=9C=93?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 backend/tests/integration/test_library_trash_api.py         | 6 +++---
 .../tests/integration/test_pending_upload_display_name.py   | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/backend/tests/integration/test_library_trash_api.py b/backend/tests/integration/test_library_trash_api.py
index 186b7e062..bea573d6a 100644
--- a/backend/tests/integration/test_library_trash_api.py
+++ b/backend/tests/integration/test_library_trash_api.py
@@ -18,7 +18,7 @@ async def file_factory(db_session):
         counter = _counter[0]
         defaults = {
             "filename": f"trash_test_{counter}.3mf",
-            "file_path": f"/tmp/trash_test_{counter}.3mf",
+            "file_path": f"/test/library/trash_test_{counter}.3mf",
             "file_size": 1024 * counter,
             "file_type": "3mf",
         }
@@ -286,14 +286,14 @@ async def test_sweeper_hard_deletes_past_retention(db_session):
 
     fresh = LibraryFile(
         filename="fresh.3mf",
-        file_path="/tmp/fresh.3mf",
+        file_path="/test/library/fresh.3mf",
         file_size=1024,
         file_type="3mf",
         deleted_at=datetime.now(timezone.utc) - timedelta(days=5),
     )
     stale = LibraryFile(
         filename="stale.3mf",
-        file_path="/tmp/stale.3mf",
+        file_path="/test/library/stale.3mf",
         file_size=2048,
         file_type="3mf",
         deleted_at=datetime.now(timezone.utc) - timedelta(days=40),
diff --git a/backend/tests/integration/test_pending_upload_display_name.py b/backend/tests/integration/test_pending_upload_display_name.py
index fa7c44337..a82337675 100644
--- a/backend/tests/integration/test_pending_upload_display_name.py
+++ b/backend/tests/integration/test_pending_upload_display_name.py
@@ -38,7 +38,7 @@ async def _seed_pending(
 ) -> int:
     pending = PendingUpload(
         filename=filename,
-        file_path=f"/tmp/{filename}",
+        file_path=f"/test/pending/{filename}",
         file_size=42,
         source_ip="192.168.1.50",
         status="pending",