False nagative: InsecureTemporaryFile misses source pattern `tempfile.NamedTemporaryFile(delete=False)` path exposure

Open

#21,669 opened on Apr 8, 2026 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty: 3/5
Estimated time: 1-2 days
Newbie friendliness: 55/100

Issue type: Feature
Clarity: Mostly clear
Activity status: Quiet
Tech stack: python
Domain: security

Research direction

Start at the InsecureTemporaryFile query and inspect how existing detections cover tempfile.mktemp and tempfile.tmpnam. Add regression coverage for the NamedTemporaryFile(delete=False) pattern when its filename is returned or exposed, then run the query's tests; the issue does not name specific files or test paths.

Written by the indexing model from the issue text.

Description

The current query only flags deprecated/insecure temporary file APIs like tempfile.mktemp and tempfile.tmpnam. However, a modern and equally dangerous source pattern involves tempfile.NamedTemporaryFile(delete=False) where the generated filename is returned or exposed elsewhere.

I encountered this pattern in a real-world GitHub repository. When delete=False is used, the temporary file persists after the context manager exits or the file handle is closed. Returning or exposing the filename creates a race window.

  def save_file_to_temp(file_obj):
      with tempfile.NamedTemporaryFile(delete=False) as temp_file:
          file_obj.seek(0)  # Go to the start of the file
          temp_file.write(file_obj.read())
          return temp_file.name

Since this uses a standard API rather than a deprecated one, linters won't flag it, making it easy to overlook.

Dominant language: CodeQL
Stars: 10.1k
Forks: 2.1k
Avg merge: 2d 16h
Merged PRs (30d): 143

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

False positive: TurkScan.com / TurkChain network Open

blocklist removal

Difficulty 2/5 1-3 hours Newbie friendliness 65/100

MetaMask/eth-phishing-detect#296544 · Opened Sep 23, 2026
Usage of curl in mcr.microsoft.com/azure-functions/dotnet-isolated:4-dotnet-isolated10.0 Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

Azure/azure-functions-docker#1257 · Opened Sep 23, 2026
build_ca_bundle.py: cap the privileged read size of the swapd-controlled CA Open

area:proxy bug security severity:low track:open-source

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

ntindle/spark-vm#300 · Opened Sep 23, 2026
versions endpoint passes commit_hash to git show unvalidated: option injection (read tier, root-level entries) Open

bug server

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

markramm/pyrite#333 · Opened Sep 23, 2026
normalizeFilePath() leaks the username whenever the viewing OS differs from the machine the path came from Open

Difficulty 2/5 1-3 hours Newbie friendliness 70/100

bytedance/UI-TARS-desktop#2009 · 1 comment · Opened Sep 23, 2026

More Security issues