Need

Secure handling of temporary files

Context

• Usage of Scala for building scalable and high-performance applications
• Usage of play.api.libs.Files for file handling in Play Framework
• Usage of java.io.File for file input/output operations

Description

Non compliant code

        import play.api.libs.Files
import java.io.File

def storeTempFile() = Action(parse.temporaryFile) { request =>
  request.body.moveTo(new File("/tmp/example.txt"), replace = true)
  Ok("File has been uploaded")
}
        
        

This code snippet is vulnerable because it uses the Play Framework's parse.temporaryFile to handle file uploads. The uploaded file is then moved to a temporary location in the system ("/tmp/example.txt") with the moveTo method.

The vulnerability lies in the storage of potentially sensitive information in a temporary file within a publicly accessible directory. This could allow an attacker to read the contents of the file, or even overwrite it, leading to information disclosure or data corruption.

Additionally, the replace = true parameter means that if a file with the same name already exists in the destination directory, it will be overwritten. This could lead to unintentional data loss if two users upload a file with the same name.

The system is vulnerable to attacks such as symlink attacks, where an attacker could create a symbolic link to a file in the /tmp directory, and the application could inadvertently overwrite that file with sensitive data.

Moreover, deploying such sensitive temporary files to the production environment increases the risk of exposing sensitive data to unauthorized users or attackers.

Steps

• Avoid storing sensitive information in temporary files
• Use secure file storage mechanisms instead of temporary files
• Ensure that temporary files are not deployed to the production environment
• Implement proper file permissions and access controls for temporary files
• Regularly clean up and delete temporary files after they are no longer needed

Compliant code

        import play.api.libs.Files
import java.io.File
import java.nio.file.{Files, Paths, StandardOpenOption}
import java.security.SecureRandom
import java.math.BigInteger

def storeTempFile() = Action(parse.temporaryFile) { request =>
  val secureFileName = new BigInteger(130, new SecureRandom()).toString(32)
  val tempFilePath = Paths.get(System.getProperty("java.io.tmpdir"), secureFileName)
  request.body.moveTo(tempFilePath.toFile, replace = true)
  Files.deleteIfExists(tempFilePath)
  Ok("File has been uploaded and deleted")
}
        
        

The original code was storing sensitive information in a temporary file without any security measures. This could lead to unauthorized access to the sensitive information.

The updated code includes several security measures:

1. Secure File Name Generation: Instead of using a static file name, we generate a secure random file name using SecureRandom and BigInteger. This makes it difficult for an attacker to guess the file name.

2. Secure Temporary File Path: We use the system's temporary directory ( java.io.tmpdir) to store the temporary file. This directory is usually restricted to only the system and the user, reducing the risk of unauthorized access.

3. File Deletion After Use: After the file has been used (in this case, after it has been moved), we delete the file using Files.deleteIfExists(). This ensures that the sensitive information does not remain in the system longer than necessary.

4. No Sensitive Information in Production Environment: By deleting the file after use, we ensure that no sensitive temporary files are deployed to the production environment.

Remember, it's always a good practice to avoid storing sensitive information in temporary files. If you must, make sure to implement proper file permissions, access controls, and clean up mechanisms.

References

• 028. Insecure temporary files