VNX-459: Incomplete Cleanup

Reports Python code that creates a temporary directory or file with tempfile.mkdtemp(), mkstemp() or NamedTemporaryFile(delete=False) and never removes it anywhere in the same file.

Field	Value
Rule ID	`VNX-459`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python
CWE	CWE-459
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`incomplete-cleanup` `cwe-459`
Source	`internal/sast/rules/vnx-459.rego`

Overview

VNX-459 maps to CWE-459: Incomplete Cleanup. It reports tempfile.mkdtemp(), tempfile.mkstemp() and tempfile.NamedTemporaryFile(..., delete=False) whose result is held in a name, attribute or with ... as target that no shutil.rmtree, os.remove, os.unlink, os.replace, Path(...).unlink, .cleanup(), atexit.register or addCleanup call in the same file receives, or that is created inline in a file with no removal at all. TemporaryDirectory(), NamedTemporaryFile() with the default delete=True, results returned or yielded to the caller, and test files are not reported.

Why This Matters

Temporary files and directories that are never removed accumulate on disk with whatever they held: extracted archives, rendered documents, uploaded data or credentials. On a shared host they outlive the process and can be read by anyone who can list the temporary directory.

What Gets Flagged

# FLAGGED: the build directory is never removed
workdir = tempfile.mkdtemp(prefix="build-")
subprocess.run(["make", "-C", workdir], check=True)

# NOT FLAGGED: removed in a finally block
workdir = tempfile.mkdtemp(prefix="build-")
try:
    subprocess.run(["make", "-C", workdir], check=True)
finally:
    shutil.rmtree(workdir, ignore_errors=True)

Remediation

Prefer with tempfile.TemporaryDirectory() as d: and with tempfile.NamedTemporaryFile() as f:.
When the object must outlive a block, remove it in a finally block or register the cleanup with atexit or addCleanup.
For confirmed false positives, add a # vulnetix-ignore: VNX-459 comment on the line.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-459
// nosec vnx-459

Or record an ignore rule: vulnetix ignore add --rule vnx-459 --reason "...". See Suppressing findings.