Cette page n'est pas encore disponible en français, sa traduction est en cours. Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.
Metadata
ID:ruby-security/hardcoded-tmp-file
Language: Ruby
Severity: Warning
Category: Security
Description
The rule of avoiding hardcoded temp files is crucial in Ruby development to ensure the security and integrity of your code. Hardcoded temp files can expose your application to several potential risks such as unauthorized file access, data corruption, or even data loss.
This is particularly important in a multi-user environment where multiple processes might try to read or write to the same file, leading to race conditions. Hardcoding temp files also disregard the system’s temp directory, which could be problematic if the system lacks the necessary permissions or space in the specified location.
To avoid this, use Ruby’s Tempfile class or Dir.mktmpdir method which automatically handle the creation and cleanup of temporary files/directories in a safe manner. For instance, instead of File.write("/tmp/myfile.txt", "foobar"), you can use Tempfile.create to create a temporary file. This ensures your application is more secure, reliable, and portable across different operating systems.
Non-Compliant Code Examples
File.write("/tmp/myfile.txt","foobar")
Seamless integrations. Try Datadog Code Analysis
Datadog Code Analysis
Try this rule and analyze your code with Datadog Code Analysis
How to use this rule
1
2
rulesets:- ruby-security # Rules to enforce Ruby security.
Create a static-analysis.datadog.yml with the content above at the root of your repository
Use our free IDE Plugins or add Code Analysis scans to your CI pipelines
