org.sonar.l10n.java.rules.squid.S2976.html Maven / Gradle / Ivy

Go to download

Show more of this group Show more artifacts with this name
Show all versions of java-checks Show documentation

There is a newer version: 8.6.0.37351


  Using File.createTempFile as the first step in creating a temporary directory causes a race condition
  and is inherently unreliable and insecure. Instead, Files.createTempDirectory (Java 7+) or
  a library function such as Guava's similarly-named Files.createTempDir should be used.

This rule raises an issue when the following steps are taken in immediate sequence:

  call to File.createTempFile
  delete resulting file
  call mkdir on the File object



  Note that this rule is automatically disabled when the project's java.source.version is lower than 7.


Noncompliant Code Example
File tempDir;
tempDir = File.createTempFile("", ".");
tempDir.delete();
tempDir.mkdir();  // Noncompliant


Compliant Solution
Path tempPath = Files.createTempDirectory("");
File tempDir = tempPath.toFile();


See

  OWAPS Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities