avoid-mktemp-python

ESS-ENN · ESS-ENN · commit a6376e17ae54 · 2024-10-17T17:44:43.000+05:30
diff --git a/rules/python/security/avoid-mktemp-python.yml b/rules/python/security/avoid-mktemp-python.yml
@@ -0,0 +1,37 @@
+id: avoid-mktemp-python
+language: python
+severity: warning
+message: >-
+  The function `mktemp` is deprecated. When using this function, it is
+  possible for an attacker to modify the created file before the filename is
+  returned. Use `NamedTemporaryFile()` instead and pass it the
+  `delete=False` parameter.
+note: >-
+  [CWE-377]: Insecure Temporary File
+  [OWASP A01:2021]: Broken Access Control
+  [REFERENCES]
+       https://docs.python.org/3/library/tempfile.html#tempfile.mktemp
+       https://owasp.org/Top10/A01_2021-Broken_Access_Control
+utils:
+  match_mktemp:
+    kind: call
+    has:
+      kind: identifier
+      pattern: $R
+    inside:
+      stopBy: end
+      kind: expression_statement
+      follows:
+        stopBy: end
+        kind: import_from_statement
+        has:
+          stopBy: end
+          kind: dotted_name
+          field: name
+          has:
+            stopBy: end
+            kind: identifier
+            pattern: $R
+rule:
+  all:
+    - matches: match_mktemp
diff --git a/tests/__snapshots__/avoid-mktemp-python-snapshot.yml b/tests/__snapshots__/avoid-mktemp-python-snapshot.yml
@@ -0,0 +1,30 @@
+id: avoid-mktemp-python
+snapshots:
+  ? |
+    from tempfile import mktemp
+    ff = mktemp()
+  : labels:
+    - source: mktemp()
+      style: primary
+      start: 33
+      end: 41
+    - source: mktemp
+      style: secondary
+      start: 21
+      end: 27
+    - source: mktemp
+      style: secondary
+      start: 21
+      end: 27
+    - source: from tempfile import mktemp
+      style: secondary
+      start: 0
+      end: 27
+    - source: ff = mktemp()
+      style: secondary
+      start: 28
+      end: 41
+    - source: mktemp
+      style: secondary
+      start: 33
+      end: 39
diff --git a/tests/python/avoid-mktemp-python-test.yml b/tests/python/avoid-mktemp-python-test.yml
@@ -0,0 +1,8 @@
+id: avoid-mktemp-python
+valid:
+  - |
+
+invalid:
+  - |
+    from tempfile import mktemp
+    ff = mktemp()
