#293 new rule: temp file lives until JVM Exit

[Hamlet D'Arcy]

http://www.klocwork.com/products/documentation/current/Checkers:SV.DOS.TMPFILEDEL

This error occurs when a temporary file is scheduled to be deleted on exit but is not explicitly deleted. This error mostly presents a problem in a server or servlet context.

Vulnerability and risk
Temporary files should be deleted as soon as possible. If a file contains sensitive information, the longer it exists, the better chance an attacker has to gain access to its contents. Also, because directories typically have limits on the number of files allowed, it is possible to overflow the number of temporary files, leading to a denial of service problem.

Klocwork Insight security vulnerability (SV) checkers identify calls that create potentially dangerous data; these calls are considered unsafe sources. An unsafe source can be any data provided by the user, since the user could be an attacker or has the potential for introducing human error. To see some examples unsafe data sources, see Examples of unsafe data sources for Java security vulnerability (SV) checkers.

Mitigation and prevention
Temporary files should be deleted immediately after use.

Example 1
17 protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {
18 String name = req.getParameter("userName");
19 File file = File.createTempFile("file", ".dat");
20 file.deleteOnExit();
21 fillWithUserData(name);
22 char[] data = readData(file);
23 resp.getWriter().print(data);
24 }
SV.DOS.TMPFILEDEL is reported for line 19: File 'file' scheduled for 'delete on exit', meaning that it will remain for the lifetime of the jvm (which can be very long in the case of a server or servlet). Server-side applications should remove files explicitly.