github / github/codeql

False nagative: InsecureTemporaryFile misses source pattern `tempfile.NamedTemporaryFile(delete=False)` path exposure

Ouverte
#21,669 0 commentaires 0 réactions 0 personnes assignées Voir sur GitHub
Langage dominant
CodeQL
Étoiles
10.1k
Forks
2.1k
Merge moyen
2 j 15 h
PR mergées (30 j)
141

Description

The current query only flags deprecated/insecure temporary file APIs like `tempfile.mktemp` and `tempfile.tmpnam`. However, a modern and equally dangerous source pattern involves `tempfile.NamedTemporaryFile(delete=False)` where the generated filename is returned or exposed elsewhere.

I encountered this [pattern ]( https://github.com/moest-np/center-randomize/blob/987c14c964556f0b6bced9238989beedafaee7aa/app.py#L112)in a real-world GitHub repository. When `delete=False` is used, the temporary file persists after the context manager exits or the file handle is closed. Returning or exposing the filename creates a race window.

```python
def save_file_to_temp(file_obj):
with tempfile.NamedTemporaryFile(delete=False) as temp_file:
file_obj.seek(0) # Go to the start of the file
temp_file.write(file_obj.read())
return temp_file.name
```

Since this uses a standard API rather than a deprecated one, linters won't flag it, making it easy to overlook.

Guide de contribution

Ouvrir le guide de contribution

Piste de recherche

Start at the InsecureTemporaryFile query and inspect how existing detections cover tempfile.mktemp and tempfile.tmpnam. Add regression coverage for the NamedTemporaryFile(delete=False) pattern when its filename is returned or exposed, then run the query's tests; the issue does not name specific files or test paths.

Rédigé par le modèle d'indexation à partir du texte de l'issue.

Évaluation

Stack technique
python
Domaine
security
Type d'issue
Fonctionnalité
Difficulté
3/5
Temps estimé
1-2 jours
Activité
Calme
Clarté
Plutôt claire
Accessibilité débutants
55/100

Recevez les nouvelles issues par e-mail

Un résumé court des issues GitHub adaptées aux débutants.