#397 HIGH: Predictable /tmp file path TOCTOU vulnerability in async_deferred_task
Description
Editasync_deferred_task.py:103-105 - Creates predictable /tmp/highway_job_{job_id}.py file path. Attacker could create symlink at this path before file write, potentially writing arbitrary content to attacker-controlled location. Fix: Use tempfile.mkstemp() with unpredictable name, or write to secure directory with restricted permissions.
Comments
Loading comments...
Context
Loading context...
Audit History
View AllLoading audit history...