update + fixes

Author: nocomplexity

constructs/mktemp.md

@@ -0,0 +1,184 @@
+# Mktemp Statement
+
+The `tempfile.mktemp()` function in Python's standard library is **deprecated and insecure**. Its use introduces a critical **Time-of-Check to Time-of-Use (TOCTOU)** vulnerability that can be exploited by attackers to compromise your application.
+
+:::{danger} 
+**Never use `tempfile.mktemp()` in new code.** The function has been deprecated since Python 2.3 (2003) and removed from Python 3.12+ documentation as a recommended practice. Its continued use represents a significant security risk with no valid justification in modern applications.
+:::
+
+## Security Concerns
+
+### Time-of-Check to Time-of-Use (TOCTOU) Vulnerability
+
+The fundamental flaw in `mktemp()` is the gap between generating a filename and actually using it:
+
+```python
+# VULNERABLE PATTERN
+filename = tempfile.mktemp()  # Step 1: Generate unique-sounding name
+# --- TIME GAP --- Attacker can create file here
+with open(filename, 'w') as f:  # Step 2: Use the filename
+    f.write(data)
+```
+
+During this time gap, an attacker can:
+1. **Create the file** with malicious content before your application does
+2. **Create a symbolic link** pointing to a critical system file (e.g., `/etc/passwd`)
+3. **Replace the file** after your application creates it but before it's fully written
+4. **Create a directory** with the same name, causing your application to fail or behave unexpectedly
+
+### Race Condition Exploitation
+
+The TOCTOU vulnerability enables several attack vectors:
+
+- **Symlink Attacks**: An attacker creates a symbolic link from the temporary filename to a sensitive file. When your application opens the file for writing, it overwrites the target instead.
+- **File Pre-creation**: An attacker creates the file before your application, potentially with malicious content or permissions that your application later reads.
+- **Denial of Service**: An attacker creates the file or directory, causing your application to crash or fail when attempting to create it.
+- **Data Leakage**: An attacker reads the file contents after creation but before your application secures them.
+
+### No Atomicity Guarantees
+
+`mktemp()` provides **no guarantees** about:
+- **Uniqueness**: The generated name is based on predictable patterns
+- **Exclusivity**: The file may not exist at creation time but could be created by an attacker
+- **Permissions**: Default permissions may be too permissive, exposing sensitive data
+- **Path Security**: The function does not verify the security of the parent directory
+
+### Predictable Name Generation
+
+The name generation algorithm in older Python versions was predictable, allowing attackers to:
+- Pre-emptively create files with known names
+- Calculate future filenames and exploit them
+- Create denial-of-service conditions by pre-creating many files
+
+```python
+import tempfile
+
+# These patterns might be predictable
+file1 = tempfile.mktemp()  # /tmp/tmp123456
+file2 = tempfile.mktemp()  # /tmp/tmp123457
+# Attacker could guess the pattern and pre-create files
+```
+
+
+## Preventive Measures
+
+### Use `tempfile.mkstemp()` Instead
+
+The safe alternative to `mktemp()` is `tempfile.mkstemp()`, which atomically creates a temporary file with exclusive access:
+
+```python
+import tempfile
+import os
+
+# SECURE: mkstemp() creates the file atomically
+fd, filename = tempfile.mkstemp(suffix='.txt', prefix='myapp_', dir='/secure/temp')
+
+try:
+    # Write data using the file descriptor
+    with os.fdopen(fd, 'w') as f:
+        f.write("Secure data")
+    
+    # Use the filename if needed
+    print(f"Created secure temp file: {filename}")
+finally:
+    # Clean up
+    os.unlink(filename)
+```
+
+### Use Context Managers for Automatic Cleanup
+
+For even better security and resource management, use `tempfile.TemporaryFile()` or `tempfile.NamedTemporaryFile()`:
+
+```python
+import tempfile
+
+# SECURE: Automatic cleanup and secure creation
+with tempfile.TemporaryFile(mode='w+', suffix='.txt', prefix='myapp_') as f:
+    f.write("Sensitive data")
+    f.seek(0)
+    data = f.read()
+# File is automatically closed and deleted on context exit
+
+# With a named file (visible in filesystem)
+with tempfile.NamedTemporaryFile(mode='w+', delete=True, suffix='.txt') as f:
+    f.write("Another secure use case")
+    # File remains accessible via f.name, but is deleted on close
+```
+
+### Use `tempfile.TemporaryDirectory` for Secure Directories
+
+For temporary directories, use the secure context manager:
+
+```python
+import tempfile
+import os
+
+# SECURE: Creates and automatically cleans up temporary directory
+with tempfile.TemporaryDirectory(prefix='myapp_') as temp_dir:
+    temp_file = os.path.join(temp_dir, 'data.txt')
+    with open(temp_file, 'w') as f:
+        f.write("Secure temporary data")
+    # Directory and all contents are removed on exit
+```
+
+### Implement Defensive Practices
+
+When creating temporary files, always:
+
+1. **Set Appropriate Permissions**: Use `os.umask()` to set restrictive permissions
+2. **Verify Directory Security**: Ensure the target directory is not world-writable
+3. **Use Absolute Paths**: Avoid relying on relative paths or environment variables
+4. **Clean Up**: Always delete temporary files after use, even in error cases
+5. **Limit Exposure**: Minimize the time temporary files exist in the filesystem
+
+### Use Secure Configuration
+
+```python
+import tempfile
+import os
+import stat
+
+def secure_temp_file(data, prefix='myapp_'):
+    """
+    Create a secure temporary file with restrictive permissions.
+    
+    Args:
+        data: Content to write to the file
+        prefix: Prefix for the temporary filename
+    
+    Returns:
+        The filename of the temporary file
+    """
+    # Set restrictive umask temporarily
+    old_umask = os.umask(0o177)
+    
+    try:
+        # Create secure temporary file
+        fd, filename = tempfile.mkstemp(prefix=prefix, text=True)
+        
+        # Set restrictive permissions (owner read/write only)
+        os.fchmod(fd, stat.S_IRUSR | stat.S_IWUSR)
+        
+        # Write data
+        with os.fdopen(fd, 'w') as f:
+            f.write(data)
+        
+        return filename
+    finally:
+        # Restore original umask
+        os.umask(old_umask)
+```
+
+
+## Discussion
+
+**Historical Context**
+
+`tempfile.mktemp()` was deprecated in Python 2.3 (2003) after security researchers identified widespread vulnerabilities in applications using the function. Despite being deprecated for over two decades, the function occasionally appears in legacy codebases and beginner tutorials, leading to continued security risks.
+
+## More Information
+
+- [Python `tempfile` Documentation](https://docs.python.org/3/library/tempfile.html)
+- [CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition](https://cwe.mitre.org/data/definitions/367.html)
+- [CWE-377: Insecure Temporary File](https://cwe.mitre.org/data/definitions/377.html)
+- [CWE-379: Creation of Temporary File in Directory with Incorrect Permissions](https://cwe.mitre.org/data/definitions/379.html)

constructs/tarfile.md

@@ -83,79 +83,3 @@ with tarfile.open("untrusted.tar.gz") as tar:
 - [Summary of Python tarfile Infinite Loop Vulnerability (CVE-2025-8194)](https://zeropath.com/blog/cve-2025-8194-python-tarfile-infinite-loop)
 
 
-
-mmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmmm
-The Python `tarfile` module makes it possible to read and write tar archives.
-
-Code Audit checks on the use of:
-* `TarFile.extract` and
-* `TarFile.extractall`
-Using these methods in Python code can give serious security concerns.
-
-
-:::{admonition} The default rule is:
-:class: danger
-Assume all input is malicious.
-:::
-
-Using these commands in Python code can expose systems to several risks:
-
-* Privilege escalation: An attacker can change file permissions on sensitive files (for example, `/etc/shadow` or SSH keys) if the extraction process runs with root or elevated privileges.
-
-* Sandbox escape: Many systems rely on extraction directories or temporary paths for isolation; malicious archives can break that isolation and allow code to operate outside the sandbox.
-
-* Tampering and log evasion: By modifying file timestamps or other metadata, an attacker can obscure activity, confuse forensic timelines, or mislead incident response.
-
-* Easy exploitation: Crafting a malicious tarball is straightforward and requires no specialized tools, making exploitation trivial for an attacker.
-
-
-:::{danger} 
-Using `TarFile.extractall` or `TarFile.extract` is dangerous.
-Always. So good mitigation measurement **must** be present in the code!
-:::
-
-But besides using these `tarfile` commands in your Python code, there have been some vulnerabilities with the `tarfile` module implementation in CPython in the past. 
-
-So from a security point of view checking if your code is extracting files using the `tarfile` command is vital. 
-
-:::{note} 
-Use of the `tarfile` extraction methods in Python code should **always** be reviewed in depth! 
-
-This means:
-* Check if the code uses defence in-depth measures for extracting files. 
-
-* Check if the files that will be extracted by the Python code can be assumed secure, so not tampered with. If not: validate if enough additional mitigation measurements are in place when using this code. 
-
-Mitigation measurements are always context dependent, and can be e.g. running the Python program in an isolated environment.
-:::
-
-## Preventive measures
-
-Never extract archives from untrusted sources without prior inspection. It is possible that files are created outside of path, e.g. members that have absolute filenames starting with `"/"` or filenames with two dots `".."`.
-
-Make sure a proper `filter` is set:
-```
-TarFile.extractall(path='.', members=None, *, numeric_owner=False, filter=None)
-```
-The filter argument specifies how members are modified or rejected before extraction. So set minimal `filter='data'` to prevent the most dangerous security issues, and read the Extraction filters section documentation for details.
-
-
-* Do not pass filter="tar" or filter="data" for untrusted archives.
-If you must unpack, force filter="none" and run in a dedicated, non-privileged container/VM.
-
-:::{note} 
-This validation test requires **always** human inspection if the construct is detected.
-No automatic test can give you enough confidence! So **no AI agent or other GenAI thing** will help you. 
-
-Using this construct is fine, but make sure you known how to prevent disasters!
-:::
-
-## More info
-
-* [CVE-2025-4330](https://www.cve.org/CVERecord?id=CVE-2025-4330)
-* [CVE-2024-12718](https://nvd.nist.gov/vuln/detail/CVE-2024-12718)
-* [CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')](https://cwe.mitre.org/data/definitions/22.html)
-* https://docs.python.org/3/library/tarfile.html#tarfile-extraction-filter 
-* [What Is The Tarfile Vulnerability in Python?](https://www.securitycompass.com/kontra/what-is-the-tarfile-vulnerability-in-python/) 
-* [Summary of Python tarfile Infinite Loop Vulnerability (CVE-2025-8194)](https://zeropath.com/blog/cve-2025-8194-python-tarfile-infinite-loop)
-* [Tarfile: Exploiting the World With a 15-Year-Old Vulnerability](https://www.trellix.com/blogs/research/tarfile-exploiting-the-world/)

toc.yml

@@ -45,6 +45,7 @@ project:
         - file: constructs/weakhash.md
         - file: constructs/ftp.md
         - file: constructs/marshal.md
+        - file: constructs/mktemp.md
 
 
     - file: guidelines/guidelines_intro.md