github / github/codeql

False nagative: InsecureTemporaryFile misses source pattern `tempfile.NamedTemporaryFile(delete=False)` path exposure

Aberta
#21,669 0 comentários 0 reações 0 responsáveis Ver no GitHub
Linguagem predominante
CodeQL
Estrelas
10.1k
Forks
2.1k
Merge médio
2d 15h
PRs com merge (30d)
141

Descrição

The current query only flags deprecated/insecure temporary file APIs like `tempfile.mktemp` and `tempfile.tmpnam`. However, a modern and equally dangerous source pattern involves `tempfile.NamedTemporaryFile(delete=False)` where the generated filename is returned or exposed elsewhere.

I encountered this [pattern ]( https://github.com/moest-np/center-randomize/blob/987c14c964556f0b6bced9238989beedafaee7aa/app.py#L112)in a real-world GitHub repository. When `delete=False` is used, the temporary file persists after the context manager exits or the file handle is closed. Returning or exposing the filename creates a race window.

```python
def save_file_to_temp(file_obj):
with tempfile.NamedTemporaryFile(delete=False) as temp_file:
file_obj.seek(0) # Go to the start of the file
temp_file.write(file_obj.read())
return temp_file.name
```

Since this uses a standard API rather than a deprecated one, linters won't flag it, making it easy to overlook.

Guia de contribuição

Abrir o guia de contribuição

Direção de pesquisa

Start at the InsecureTemporaryFile query and inspect how existing detections cover tempfile.mktemp and tempfile.tmpnam. Add regression coverage for the NamedTemporaryFile(delete=False) pattern when its filename is returned or exposed, then run the query's tests; the issue does not name specific files or test paths.

Escrita pelo modelo de indexação a partir do texto da issue.

Avaliação

Stack de tecnologia
python
Domínio
security
Tipo de issue
Funcionalidade
Dificuldade
3/5
Tempo estimado
1-2 dias
Status de atividade
Pouca atividade
Clareza
Razoavelmente clara
Facilidade para iniciantes
55/100

Receba novas issues na sua caixa de entrada

Um resumo curto de issues do GitHub para quem está começando.