🔒 fix: use secure temporary files in catalog persistence

[edithatogo]

🎯 What:

The catalog.rs module contained an insecure temporary file creation vulnerability. When persisting the catalog to disk (LocalCatalog::save_atomic), it constructed a predictable .tmp path based on the target filename. It then removed any existing file at that location and created a new file with that exact predictable name to write the new catalog output.

⚠️ Risk:

This approach introduces a Time-of-Check to Time-of-Use (TOCTOU) condition and predictability vulnerability. A malicious actor with write access to the directory could anticipate the .tmp file name and replace it with a symlink or alternate file, potentially resulting in unauthorized file overwrite (clobbering) or tampering with the dataset catalog when fs::rename is executed.

🛡️ Solution:

Removed the bespoke tmp_path_for path generation and replaced the file persistence logic using the tempfile crate's NamedTempFile api. The new implementation creates a unique, cryptographically random temporary file securely within the destination directory and atomically replaces the original file using persist(). This closes the race condition and uses the operating system's facilities for safe temporary file handling.

---

PR created automatically by Jules for task 17544339023431912651 started by @edithatogo

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[cursor]

Bugbot is not enabled for your account, so this pull request was not reviewed.

Enable Bugbot in the Cursor dashboard to get automatic reviews on future PRs.