SV.TMPFILE

This error appears when unvalidated user input enters an API for temporary file creation as a prefix, suffix or temporary directory path.

Vulnerability and risk

This situation can lead to Path Manipulation or Denial of Service. With Path Manipulation, a user can manipulate a path to a temporary file to make it available in non-protected directories, for example in web root. A user can make this method throw an IllegalArgumentException (for example, if a prefix is too short). This situation could also result in an IOException, which can cause denial-of-service (DoS) to the application, if it is not properly processed.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Never use user data for names of temporary files.

Example 1

Copy

15
16
17
18
19
20
21
22
23
24
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
         String name = req.getParameter("USERNAME");
         File file = File.createTempFile(name, ".tmp");
         dumpSensitiveInfoAndRunSomeApp(file);
         file.delete();
     }
 
     private void dumpSensitiveInfoAndRunSomeApp(File file) {
         // ...
     }

SV.TMPFILE is reported for line 17: 'name' contains data coming from an HTTP request parameter and might be tainted (line 16). This value is used to create the temporary file on line 17. This can be used to create temporary files in different locations, allowing access escalation or DoS.

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Local File Inclusion Training Video - Test your skills with a training example

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.