False nagative: InsecureTemporaryFile misses source pattern `tempfile.NamedTemporaryFile(delete=False)` path exposure
- Langage dominant
- CodeQL
- Étoiles
- 10.1k
- Forks
- 2.1k
- Merge moyen
- 2 j 15 h
- PR mergées (30 j)
- 141
Description
The current query only flags deprecated/insecure temporary file APIs like `tempfile.mktemp` and `tempfile.tmpnam`. However, a modern and equally dangerous source pattern involves `tempfile.NamedTemporaryFile(delete=False)` where the generated filename is returned or exposed elsewhere.
I encountered this [pattern ]( https://github.com/moest-np/center-randomize/blob/987c14c964556f0b6bced9238989beedafaee7aa/app.py#L112)in a real-world GitHub repository. When `delete=False` is used, the temporary file persists after the context manager exits or the file handle is closed. Returning or exposing the filename creates a race window.
```python
def save_file_to_temp(file_obj):
with tempfile.NamedTemporaryFile(delete=False) as temp_file:
file_obj.seek(0) # Go to the start of the file
temp_file.write(file_obj.read())
return temp_file.name
```
Since this uses a standard API rather than a deprecated one, linters won't flag it, making it easy to overlook.
Guide de contribution
Ouvrir le guide de contribution
Piste de recherche
Start at the InsecureTemporaryFile query and inspect how existing detections cover tempfile.mktemp and tempfile.tmpnam. Add regression coverage for the NamedTemporaryFile(delete=False) pattern when its filename is returned or exposed, then run the query's tests; the issue does not name specific files or test paths.
Rédigé par le modèle d'indexation à partir du texte de l'issue.
Évaluation
- Stack technique
- python
- Domaine
- security
- Type d'issue
- Fonctionnalité
- Difficulté
- 3/5
- Temps estimé
- 1-2 jours
- Activité
- Calme
- Clarté
- Plutôt claire
- Accessibilité débutants
- 55/100