Do not hardcode temporary file or directory names
Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel,
n'hésitez pas à nous contacter.
ID: python-security/hardcoded-tmp-file
Language: Python
Severity: Info
Category: Best Practices
CWE: 377
Description
Do not hardcode the names of temporary files or directories. This may constitute a security vulnerability because an attacker might use that name to create a link to a file they want to overwrite or read.
Instead of hardcoding values, use the tempfile Python module to create unpredictable names.
Learn More
Non-Compliant Code Examples
with open("/tmp/acme.pub", "rb") as key_file:
public_key = serialization.load_pem_public_key(
key_file.read(),
backend=default_backend()
)
def foobar():
api_key_file = Path('/tmp/supersecret.txt')
keyfile = '/tmp/vulpy.apikey.{}.{}'.format(username, key)
keyfile = f"/tmp/vulpy.apikey.{username}.{key}"
def authenticate(request):
if 'X-APIKEY' not in request.headers:
return None
key = request.headers['X-APIKEY']
for f in Path('/tmp/').glob('vulpy.apikey.*.' + key):
return f.name.split('.')[2]
return None
Compliant Code Examples
secure_temp = tempfile.mkstemp(prefix="pre_",suffix="_suf")
print(secure_temp)
temp = tempfile.NamedTemporaryFile()
print(temp)
print(temp.name)
