SV.TMPFILE

Temporary file path tampering

This error appears when unvalidated user input enters an API for temporary file creation as a prefix, suffix or temporary directory path.

As of release 2023.2, this checker supports Jakarta EE.

Vulnerability and risk

This situation can lead to Path Manipulation or Denial of Service. With Path Manipulation, a user can manipulate a path to a temporary file to make it available in non-protected directories, for example in web root. A user can make this method throw an IllegalArgumentException (for example, if a prefix is too short). This situation could also result in an IOException, which can cause denial-of-service (DoS) to the application, if it is not properly processed.

Klocwork security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error.

Mitigation and prevention

Never use user data for names of temporary files.

Vunerable code example 1

Copy

1
2
3
4
5
6
7
8
9
10
11
     import javax.servlet.http.*;
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
         String name = req.getParameter("USERNAME");
         File file = File.createTempFile(name, ".tmp");
         dumpSensitiveInfoAndRunSomeApp(file);
         file.delete();
     }
 
     private void dumpSensitiveInfoAndRunSomeApp(File file) {
         // ...
     }

Klocwork reports an SV.TMPFILE defect for line 4, indicating: 'name' contains data coming from an HTTP request parameter and might be tainted (line 3). This value is used to create the temporary file on line 4 that can be used to create temporary files in different locations, allowing access escalation or DoS.

Vunerable code example 2

Copy

1
2
3
4
5
6
7
8
9
10
11
     import jakarta.servlet.http.*;
     protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
         String name = req.getParameter("USERNAME");
         File file = File.createTempFile(name, ".tmp");
         dumpSensitiveInfoAndRunSomeApp(file);
         file.delete();
     }
 
     private void dumpSensitiveInfoAndRunSomeApp(File file) {
         // ...
     }

Klocwork reports an SV.TMPFILE defect for line 4, indicating: 'name' contains data coming from an HTTP request parameter and might be tainted (line 3). This value is used to create the temporary file on line 4 that can be used to create temporary files in different locations, allowing access escalation or DoS.

External guidance

Security training

Application security training materials provided by Secure Code Warrior.

Path Traversal Training Video - Test your skills with a training example

Extension

This checker can be extended through the Klocwork knowledge base. See Tuning Java analysis for more information.