Do not hardcode temp file or directory
このページは日本語には対応しておりません。随時翻訳に取り組んでいます。翻訳に関してご質問やご意見ございましたら、お気軽にご連絡ください。
ID: python-security/hardcoded-tmp-file
Language: Python
Severity: Info
Category: Best Practices
Description
Do not hardcode the name or directory of temporary files. Use the tempfile Python instead of hardcoding values.
Learn More
Non-Compliant Code Examples
with open("/tmp/acme.pub", "rb") as key_file:
public_key = serialization.load_pem_public_key(
key_file.read(),
backend=default_backend()
)
def foobar():
api_key_file = Path('/tmp/supersecret.txt')
keyfile = '/tmp/vulpy.apikey.{}.{}'.format(username, key)
keyfile = f"/tmp/vulpy.apikey.{username}.{key}"
def authenticate(request):
if 'X-APIKEY' not in request.headers:
return None
key = request.headers['X-APIKEY']
for f in Path('/tmp/').glob('vulpy.apikey.*.' + key):
return f.name.split('.')[2]
return None
Compliant Code Examples
secure_temp = tempfile.mkstemp(prefix="pre_",suffix="_suf")
print(secure_temp)
temp = tempfile.NamedTemporaryFile()
print(temp)
print(temp.name)
Seamless integrations. Try Datadog Code Analysis
