Always explicitly set secure permissions on temporary files immediately after creation. This includes granting read and write access only to the owner, and disabling execute permissions unless explicitly required. For example, use tempFile.setReadable(true, true), tempFile.setWritable(true, true), and tempFile.setExecutable(false) to restrict access appropriately.
Avoid relying on default file permissions or omitting permission settings altogether, as this can lead to overly permissive access. By following these best practices, you minimize security risks associated with temporary files in your Java applications.
Non-Compliant Code Examples
importjava.io.File;importjava.io.IOException;publicclassSecureTempFileWithPermissionsExample{publicstaticvoidmain(String[]args)throwsIOException{FiletempFile=File.createTempFile("secure_tempfile_",".tmp");tempFile.setReadable(true,true);tempFile.deleteOnExit();System.out.println("Temporary file created with secure permissions at: "+tempFile.getAbsolutePath());}}
importjava.io.File;importjava.io.IOException;publicclassSecureTempFileExample{publicstaticvoidmain(String[]args)throwsIOException{FiletempFile=File.createTempFile("tempfile_",".tmp");tempFile.deleteOnExit();System.out.println("Temporary file created at: "+tempFile.getAbsolutePath());}}
Compliant Code Examples
importjava.io.File;importjava.io.IOException;publicclassSecureTempFileWithPermissionsExample{publicstaticvoidmain(String[]args)throwsIOException{FiletempFile=File.createTempFile("secure_tempfile_",".tmp");tempFile.setReadable(true,true);tempFile.setWritable(true,true);tempFile.setExecutable(false);tempFile.deleteOnExit();System.out.println("Temporary file created with secure permissions at: "+tempFile.getAbsolutePath());}}
Seamless integrations. Try Datadog Code Security
Datadog Code Security
Try this rule and analyze your code with Datadog Code Security
How to use this rule
1
2
rulesets:- java-security # Rules to enforce Java security.
Create a static-analysis.datadog.yml with the content above at the root of your repository
Use our free IDE Plugins or add Code Security scans to your CI pipelines