Insecure use of temporary file

[antong]

There are multiple insecure uses of temporary files in the vscode-go extension. I found the following just looking at the output console:

• $TMPDIR/go-code-cover . Command palette: "> Go Toggle Test Coverage In Current Package".
• $TMPDIR/go-code-check.* . See Using vscode-go from multiple user accounts clashes on /tmp/go-code-check #1829.
• $TMPDIR/vscode-go-debug.txt . Created when debugging with trace: "true" in the launch config.

On a multi-user or shared system such clashing or predictable use of temporary files is a hassle at best (two users cannot use vscode without errors) to a serious security issue at worst.

For example, on some system configurations user Bob can overwrite arbitrary files belonging to user Alice (or root) using a symlink attack:

bob@box$ ln -s /home/alice/thesis.tex /tmp/go-code-cover
bob@box$ ln -s /etc/passwd /tmp/vscode-go-debug.txt 

(This example is prevented on modern Linux systems if /tmp has the sticky bit set.)

Recommendation: use secure library functions for temporary files and private files (e.g., in the home directory or workspace) for non-temporary files.

[ramya-rao-a]

use secure library functions for temporary files

Can you elaborate on this?

[antong]

Because of the pitfalls in using temporary files, most systems include ready functions to securely create temporary files. POSIX has a family of functions like mkstemp(), mkdtemp(), ... Go has ioutil.TempFile() and ioutil.TempDir(). Python has a tempfile module. I'm not sure about Javascript, but googling found fs.mkdtemp() in Node.js.

By the way, thank you @ramya-rao-a for all your work on vscode-go! It is really appreciated.

[ramya-rao-a]

Thanks for the links!

PRs are welcome to fix this.
Code pointers:

• Read Build and Debug Go extension for local setup of the extension
• As mentioned above fs.mkdtemp can be used to create a unique temp directory under the os.tmpdir()
• The above should be done once and the value should be stored in local storage for future use.
• util.ts would be the right place to add a function to get this tmp dir

[0xch4z]

I'll take this!

[ramya-rao-a]

The fix for this is now out in the latest update to this extension (0.6.90)