Temporary-file template with fewer than six trailing X characters
ID |
objectivec.maintainability.mktemp_insufficient_x |
Severity |
low |
Remediation Complexity |
trivial |
Remediation Risk |
low |
Remediation Effort |
low |
Resource |
Api Misuse |
Language |
Objective-C |
Description
Reports a call to mktemp, mkstemp, mkstemps or mkdtemp whose template ends in one to five X characters, or contains none at all - either passed as a literal in the call itself, or declared as a char array literal earlier in the same block and handed to the call. A template already ending in six or more `X`s, and one whose placeholder run is followed by a suffix, are not reported.
Rationale
These functions replace exactly the last six X characters of the template. Given fewer, mkstemp and mkdtemp do not truncate or improvise - they fail outright with EINVAL, and because the failure arrives as a -1 return that this kind of code rarely checks, the first symptom is usually a later read or write against file descriptor -1. mktemp is worse: it does substitute, but a shorter run leaves far fewer candidate names, so an attacker with write access to the directory can enumerate the whole space and pre-create the file the program is about to open.
The following code illustrates the pattern detected by this rule:
@implementation Spooler
- (int)openSpoolFile {
char path[] = "/tmp/spoolXXX";
// FLAGGED: Temporary-file template with fewer than six trailing X characters
return mkstemp(path);
}
- (void)log:(NSString *)text { }
@endRemediation
End the template with exactly six X characters - "/tmp/appXXXXXX" - or, for mkstemps, six X`s immediately before the suffix. In Objective-C prefer Foundation entirely: `NSTemporaryDirectory() combined with [[NSUUID UUID] UUIDString], or NSFileManager URLForDirectory:inDomain:appropriateForURL:create:error:, both of which produce a unique path without a template and without the create-after-name race that mktemp has by design.