# V5329. OWASP. Using non-atomic file creation is not recommended because an attacker might intercept file ownership.

The analyzer has detected the use of an insecure method for creating temporary files. This can expose the application to attacks via the file system.

This vulnerability can be categorized under the OWASP Top 10 2021 classification as follows:

- A1:2021 - Broken Access Control

Calling the insecure `createTempFile` method from the `java.io.File` class is considered inherently insecure if it is executed along with a call to the `mkdir` or `mkdirs` methods:

    public File createTemporaryDirectory() {
      File dir = new File(baseDirFactory.create(),
                          CollectionUtils.join("/", path));
      GFileUtils.mkdirs(dir);
      try {
          File tmpDir = File.createTempFile("gradle",
                                            "projectDir",
                                            dir);
          tmpDir.delete();
          tmpDir.mkdir();
          return tmpDir;
      } catch (IOException e) {
          throw new UncheckedIOException(e);
      }
    }

Creating temporary files in a non-atomic way can lead to a race condition in the application behavior. This allows a third party to create the file at the moment when the application selects its name and it actually creates it. In this case, the application may use a file it does not truly control.

Attackers can gain access to and control over a vulnerable application's temporary file and modify it, potentially altering the application logic.

To harden security, create the temporary file using the `createTempDirectory` method from the `java.nio.file.Files` class:

    public File createTemporaryDirectory() {
      try {
          File dir = new File(baseDirFactory.create(),
                              CollectionUtils.join("/", path));
          GFileUtils.mkdirs(dir);

          Path tempDir = Files.createTempDirectory(dir.toPath(),
                                                   "gradle");
          return tempDir.toFile();
      } catch (IOException e) {
          throw new UncheckedIOException(e);
      }
    }

This diagnostic is classified as:

CWE-377 CWE-379