Metadata

ID: java-security/tempfile-delete

Language: Java

Severity: Warning

Category: Security

CWE: 459

Description

This rule identifies instances where temporary files are created but not properly deleted after use. Leaving temporary files undeleted can lead to resource leaks, unnecessary disk space consumption, and potential exposure of sensitive data if the files contain confidential information.

To comply with this rule, always delete temporary files explicitly when they are no longer needed, or use mechanisms like deleteOnExit() to schedule automatic deletion when the JVM terminates. For example, after creating a temporary file with File.createTempFile(), invoke tempFile.deleteOnExit() to ensure cleanup. This practice helps maintain application stability and security.

Non-Compliant Code Examples

import java.io.File;
import java.io.IOException;

public class SecureTempFileExample {
    public static void main(String[] args) throws IOException {
        File tempFile = File.createTempFile("tempfile_", ".tmp");
        System.out.println("Temporary file created at: " + tempFile.getAbsolutePath());
    }
}

Compliant Code Examples

import java.io.File;
import java.io.IOException;

public class SecureTempFileWithPermissionsExample {
    public static void main(String[] args) throws IOException {
        File tempFile = File.createTempFile("secure_tempfile_", ".tmp");
        tempFile.deleteOnExit();
        System.out.println("Temporary file created with secure permissions at: " 
            + tempFile.getAbsolutePath());
    }
}