class

Flaw::InsecureTempfile

Inherits Flaw::Rule < Reference < Object

FLAW013 — Insecure tempfile. /tmp/#{rand} or File.tempname + File.write without atomic O_EXCL | O_CREAT is a classic symlink/race attack. Use File.tempfile which opens O_EXCL.

Constants

PATTERNS = [/File\.write\s*\(\s*File\.tempname\b/, /File\.write\s*\(\s*"\/tmp\/[^"]*\#\{/, /"\/tmp\/\#\{rand/]

Instance methods

check(source : String, path : String) : Array(Finding)
Source
default_severity
Source
description
Source
title
Source