Use mkdtemp for secure temp files

src/goBuild.ts

@@ -1,6 +1,6 @@
 import path = require('path');
 import vscode = require('vscode');
-import { getToolsEnvVars, runTool, ICheckResult, handleDiagnosticErrors, getWorkspaceFolderPath, getCurrentGoPath, getUserNameHash } from './util';
+import { getToolsEnvVars, runTool, ICheckResult, handleDiagnosticErrors, getWorkspaceFolderPath, getCurrentGoPath, getTempFilePath } from './util';
 import { outputChannel } from './goStatus';
 import os = require('os');
 import { getNonVendorPackages } from './goPackages';
@@ -70,7 +70,7 @@ export function goBuild(fileUri: vscode.Uri, goConfig: vscode.WorkspaceConfigura
 	}
 
 	const buildEnv = Object.assign({}, getToolsEnvVars());
-	const tmpPath = path.normalize(path.join(os.tmpdir(), 'go-code-check.' + getUserNameHash()));
+	const tmpPath = getTempFilePath('go-code-check');
 	const isTestFile = fileUri && fileUri.fsPath.endsWith('_test.go');
 	const buildFlags: string[] = isTestFile ? getTestFlags(goConfig, null) : (Array.isArray(goConfig['buildFlags']) ? [...goConfig['buildFlags']] : []);
 	const buildArgs: string[] = isTestFile ? ['test', '-c'] : ['build'];

src/goCheck.ts

@@ -11,7 +11,7 @@ import os = require('os');
 import { getCoverage } from './goCover';
 import { outputChannel, diagnosticsStatusBarItem } from './goStatus';
 import { goTest } from './testUtils';
-import { ICheckResult, getBinPath } from './util';
+import { ICheckResult, getBinPath, getTempFilePath } from './util';
 import { goLint } from './goLint';
 import { goVet } from './goVet';
 import { goBuild } from './goBuild';
@@ -69,7 +69,7 @@ export function check(fileUri: vscode.Uri, goConfig: vscode.WorkspaceConfigurati
 
 		let args = [...buildFlags];
 		if (goConfig['coverOnSave']) {
-			tmpCoverPath = path.normalize(path.join(os.tmpdir(), 'go-code-cover'));
+			tmpCoverPath = getTempFilePath('go-code-cover');
 			args = ['-coverprofile=' + tmpCoverPath, ...buildFlags];
 		}
 

src/goCover.ts

@@ -8,6 +8,7 @@ import vscode = require('vscode');
 import path = require('path');
 import os = require('os');
 import fs = require('fs');
+import { getTempFilePath } from './util';
 import { showTestOutput, goTest } from './testUtils';
 import rl = require('readline');
 
@@ -112,7 +113,7 @@ export function toggleCoverageCurrentPackage() {
 	let cwd = path.dirname(editor.document.uri.fsPath);
 
 	let buildFlags = goConfig['testFlags'] || goConfig['buildFlags'] || [];
-	let tmpCoverPath = path.normalize(path.join(os.tmpdir(), 'go-code-cover'));
+	let tmpCoverPath = getTempFilePath('go-code-cover');
 	let args = ['-coverprofile=' + tmpCoverPath, ...buildFlags];
 	return goTest({
 		goConfig: goConfig,

src/goMain.ts

@@ -29,7 +29,7 @@ import { showTestOutput, cancelRunningTests } from './testUtils';
 import * as goGenerateTests from './goGenerateTests';
 import { addImport, addImportToWorkspace } from './goImport';
 import { installAllTools, checkLanguageServer } from './goInstallTools';
-import { isGoPathSet, getBinPath, sendTelemetryEvent, getExtensionCommands, getGoVersion, getCurrentGoPath, getToolsGopath, handleDiagnosticErrors, disposeTelemetryReporter, getToolsEnvVars } from './util';
+import { isGoPathSet, getBinPath, sendTelemetryEvent, getExtensionCommands, getGoVersion, getCurrentGoPath, getToolsGopath, handleDiagnosticErrors, disposeTelemetryReporter, getToolsEnvVars, cleanupTempDir } from './util';
 import { LanguageClient, RevealOutputChannelOn, FormattingOptions, ProvideDocumentFormattingEditsSignature, ProvideCompletionItemsSignature } from 'vscode-languageclient';
 import { clearCacheForTools, fixDriveCasingInWindows } from './goPath';
 import { addTags, removeTags } from './goModifytags';
@@ -50,7 +50,6 @@ export let errorDiagnosticCollection: vscode.DiagnosticCollection;
 export let warningDiagnosticCollection: vscode.DiagnosticCollection;
 
 export function activate(ctx: vscode.ExtensionContext): void {
-
 	let useLangServer = vscode.workspace.getConfiguration('go')['useLanguageServer'];
 
 	updateGoPathGoRootFromConfig().then(() => {
@@ -402,7 +401,7 @@ export function activate(ctx: vscode.ExtensionContext): void {
 }
 
 export function deactivate() {
-	return Promise.all([disposeTelemetryReporter(), cancelRunningTests()]);
+	return Promise.all([disposeTelemetryReporter(), cancelRunningTests(), Promise.resolve(cleanupTempDir())]);
 }
 
 function runBuilds(document: vscode.TextDocument, goConfig: vscode.WorkspaceConfiguration) {

src/goTest.ts

@@ -8,6 +8,7 @@
 import path = require('path');
 import vscode = require('vscode');
 import os = require('os');
+import { getTempFilePath } from './util';
 import { goTest, TestConfig, getTestFlags, getTestFunctions, getBenchmarkFunctions, extractInstanceTestName, findAllTestSuiteRuns } from './testUtils';
 import { getCoverage } from './goCover';
 
@@ -212,7 +213,7 @@ function makeCoverData(goConfig: vscode.WorkspaceConfiguration, confFlag: string
 	let tmpCoverPath = '';
 	let testFlags = getTestFlags(goConfig, args) || [];
 	if (goConfig[confFlag] === true) {
-		tmpCoverPath = path.normalize(path.join(os.tmpdir(), 'go-code-cover'));
+		tmpCoverPath = getTempFilePath('go-code-cover');
 		testFlags.push('-coverprofile=' + tmpCoverPath);
 	}
 

src/util.ts

@@ -844,3 +844,42 @@ export function makeMemoizedByteOffsetConverter(buffer: Buffer): (byteOffset: nu
 	};
 }
 
+function rmdirRecursive(dir) {
+	if (fs.existsSync(dir)) {
+		fs.readdirSync(dir).forEach(file => {
+			const relPath = path.join(dir, file);
+			if (fs.lstatSync(relPath).isDirectory()) {
+				rmdirRecursive(dir);
+			} else {
+				fs.unlinkSync(relPath);
+			}
+		});
+		fs.rmdirSync(dir);
+	}
+}
+
+let tmpDir: string;
+
+/**
+ * Returns file path for given name in temp dir
+ * @param name Name of the file
+ */
+export function getTempFilePath(name: string): string {
+	if (!tmpDir) {
+		tmpDir = fs.mkdtempSync(os.tmpdir() + path.sep + 'vscode-go');
+	}
+
+	if (!fs.existsSync(tmpDir)) {
+		fs.mkdirSync(tmpDir);
+	}
+
+	return path.normalize(path.join(tmpDir, name));
+}
+
+export function cleanupTempDir() {
+	if (!tmpDir) {
+		rmdirRecursive(tmpDir);
+	}
+	tmpDir = undefined;
+}
+