Using File.createTempFile
as the first step in creating a temporary directory causes a race condition and is inherently unreliable and
insecure. Instead, Files.createTempDirectory
(Java 7+) or a library function such as Guava's similarly-named
Files.createTempDir
should be used.
This rule raises an issue when the following steps are taken in immediate sequence:
File.createTempFile
mkdir
on the File object Note that this rule is automatically disabled when the project's sonar.java.source
is lower than 7
.
File tempDir; tempDir = File.createTempFile("", "."); tempDir.delete(); tempDir.mkdir(); // Noncompliant
Path tempPath = Files.createTempDirectory(""); File tempDir = tempPath.toFile();