Permissive temporary file creation

  • Rule ID: go_gosec_filesystem_tempfile
  • Languages: go
  • Source: tempfile.yml

Description

Your application creates temporary files in shared system directories like /tmp or /var/tmp without using secure functions such as os.CreateTemp. This method is risky as it could lead to symlink attacks. In such attacks, an attacker predicts the name of the temporary file and creates a symlink to a target file. Consequently, when your application writes to the supposed temporary file, it could unintentionally overwrite or create unauthorized files.

Remediations

  • Do use os.CreateTemp for creating temporary files. This function helps in securely generating temporary files within a directory that only your application can access, significantly reducing the risk of symlink attacks.
    f, err := os.CreateTemp(restrictedDir, "temp-*.txt")
  • Do not use shared temporary directories for operations that involve sensitive data or require secure file handling.
  • Do ensure temporary files are removed after their intended use to avoid accumulation and potential security risks.

References

Associated CWE

Configuration

To skip this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --skip-rule=go_gosec_filesystem_tempfile

To run only this rule during a scan, use the following flag

bearer scan /path/to/your-project/ --only-rule=go_gosec_filesystem_tempfile