github / github/codeql

False nagative: InsecureTemporaryFile misses source pattern `tempfile.NamedTemporaryFile(delete=False)` path exposure

Offen
#21,669 0 Kommentare 0 Reaktionen 0 zugewiesene Personen Auf GitHub ansehen
Vorherrschende Sprache
CodeQL
Sterne
10.1k
Forks
2.1k
Ø Merge
2 T. 15 Std.
Gemergte PRs (30 T.)
141

Beschreibung

The current query only flags deprecated/insecure temporary file APIs like `tempfile.mktemp` and `tempfile.tmpnam`. However, a modern and equally dangerous source pattern involves `tempfile.NamedTemporaryFile(delete=False)` where the generated filename is returned or exposed elsewhere.

I encountered this [pattern ]( https://github.com/moest-np/center-randomize/blob/987c14c964556f0b6bced9238989beedafaee7aa/app.py#L112)in a real-world GitHub repository. When `delete=False` is used, the temporary file persists after the context manager exits or the file handle is closed. Returning or exposing the filename creates a race window.

```python
def save_file_to_temp(file_obj):
with tempfile.NamedTemporaryFile(delete=False) as temp_file:
file_obj.seek(0) # Go to the start of the file
temp_file.write(file_obj.read())
return temp_file.name
```

Since this uses a standard API rather than a deprecated one, linters won't flag it, making it easy to overlook.

Beitragsleitfaden

Beitragsleitfaden öffnen

Rechercherichtung

Start at the InsecureTemporaryFile query and inspect how existing detections cover tempfile.mktemp and tempfile.tmpnam. Add regression coverage for the NamedTemporaryFile(delete=False) pattern when its filename is returned or exposed, then run the query's tests; the issue does not name specific files or test paths.

Vom Indexierungsmodell aus dem Issue-Text verfasst.

Bewertung

Tech-Stack
python
Bereich
security
Issue-Typ
Feature
Schwierigkeit
3/5
Geschätzter Aufwand
1-2 Tage
Aktivitätsstatus
Ruhig
Klarheit
Größtenteils klar
Anfängerfreundlichkeit
55/100

Neue Issues direkt in Ihr Postfach

Eine kurze Übersicht über anfängerfreundliche GitHub-Issues.