From e4a77911175f4efcbf7875282a73bd1f9aff7d31 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 1 Feb 2026 14:01:14 +0000
Subject: [PATCH 1/3] Initial plan


From 859a0825d0f0f467b70f50fe12c36e9d3a0eaad3 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 1 Feb 2026 14:05:08 +0000
Subject: [PATCH 2/3] Fix hardcoded temporary directory security issue (Issue
 #47)

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 app/tasks/embed_metadata_into_pdf.py | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/app/tasks/embed_metadata_into_pdf.py b/app/tasks/embed_metadata_into_pdf.py
index 6828e9a0..28ab90b1 100644
--- a/app/tasks/embed_metadata_into_pdf.py
+++ b/app/tasks/embed_metadata_into_pdf.py
@@ -2,6 +2,7 @@
 
 import os
 import shutil
+import tempfile
 import PyPDF2  # Replace fitz with PyPDF2
 import json
 from app.config import settings
@@ -62,10 +63,12 @@ def embed_metadata_into_pdf(local_file_path: str, extracted_text: str, metadata:
             print(f"[ERROR] Local file {local_file_path} not found, cannot embed metadata.")
             return {"error": "File not found"}
 
-    # Work on a safe copy in /tmp
-    tmp_dir = "/tmp"
+    # Work on a safe copy in a secure temporary directory
     original_file = local_file_path
-    processed_file = os.path.join(tmp_dir, f"processed_{os.path.basename(local_file_path)}")
+    # Create a temporary file with the same extension as the original
+    _, ext = os.path.splitext(local_file_path)
+    with tempfile.NamedTemporaryFile(mode='wb', suffix=ext, prefix='processed_', delete=False) as tmp_file:
+        processed_file = tmp_file.name
 
     # Create a safe copy to work on
     shutil.copy(original_file, processed_file)
@@ -132,4 +135,11 @@ def embed_metadata_into_pdf(local_file_path: str, extracted_text: str, metadata:
 
     except Exception as e:
         print(f"[ERROR] Failed to embed metadata into {processed_file}: {e}")
+        # Clean up temporary file in case of error
+        if os.path.exists(processed_file):
+            try:
+                os.remove(processed_file)
+                print(f"[INFO] Cleaned up temporary file {processed_file}")
+            except Exception as cleanup_error:
+                print(f"[ERROR] Could not clean up temporary file {processed_file}: {cleanup_error}")
         return {"error": str(e)}

From b17bba225f0416409bd53d7f5b070e7e16011856 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Sun, 1 Feb 2026 14:05:51 +0000
Subject: [PATCH 3/3] Address code review feedback on temporary file handling

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
---
 app/tasks/embed_metadata_into_pdf.py | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/app/tasks/embed_metadata_into_pdf.py b/app/tasks/embed_metadata_into_pdf.py
index 28ab90b1..25545c70 100644
--- a/app/tasks/embed_metadata_into_pdf.py
+++ b/app/tasks/embed_metadata_into_pdf.py
@@ -67,8 +67,9 @@ def embed_metadata_into_pdf(local_file_path: str, extracted_text: str, metadata:
     original_file = local_file_path
     # Create a temporary file with the same extension as the original
     _, ext = os.path.splitext(local_file_path)
-    with tempfile.NamedTemporaryFile(mode='wb', suffix=ext, prefix='processed_', delete=False) as tmp_file:
-        processed_file = tmp_file.name
+    tmp_file = tempfile.NamedTemporaryFile(mode='wb', suffix=ext, prefix='processed_', delete=False)
+    processed_file = tmp_file.name
+    tmp_file.close()
 
     # Create a safe copy to work on
     shutil.copy(original_file, processed_file)