SEC019
Temp file race condition
Object Pascal — Delphi & Free Pascal
Warning
Security
Predictable temp file names allow attackers to pre-create symlinks (TOCTOU attack)
predictable temp file names allow attackers to pre-create symlinks (TOCTOU attack).
Why this severity
predictable temp file names allow attackers to pre-create symlinks (TOCTOU attack).
Known false positives
temp files created in a protected directory with restricted ACLs.
Remediation example
TempFile := TPath.GetTempFileName; // OS generates a unique name atomically