CPP: Add query for CWE-377 Insecure Temporary File

[ihsinme]

Our request is looking for situations of unsafe work with files. use validation functions in the first place without guaranteeing that the file will not be created later. in the second case, he looks for places to work with the file, when his name is predictable and there are no restrictions on access rights.

CVE-2012-0786
CVE-2018-6198
CVE-2007-5936

links to real work results, I will add later. I am currently working on them with developers.

[MathiasVP]

Thanks for another contribution, @ihsinme. Here is my first round of comments.

[MathiasVP]

It looks like our CI is failing with a couple of errors:

• First:

File "ql/cpp/ql/src/experimental/Security/CWE/CWE-377/InsecureTemporaryFile.ql" contains a non-ASCII character at the location marked with `|` in:
2021-10-26T10:38:41.8453269Z ```
2021-10-26T10:38:41.8454787Z etTarget().hasGlobalOrStdName("chmod")
2021-10-26T10:38:41.8455619Z   ) and
2021-10-26T10:38:41.8456395Z   msg =
2021-10-26T10:38:41.8456832Z     "|
2021-10-26T10:38:41.8457197Z ```

Sounds like there's a hidden non-ASCII character around line 94.

• Second:

ql/cpp/ql/src/experimental/Security/CWE/CWE-377/InsecureTemporaryFile.qhelp:8:3: The element type "overview" must be terminated by the matching end-tag "</overview>".

[ihsinme]

Good afternoon.
thanks for your comments.
I apologize for the delay in my response.
I will try to answer in the coming days.

[ihsinme]

Good afternoon @MathiasVP.

Please tell me what the error is during the assembly. (I fixed the previous error)

[MathiasVP]

It's still complaining about a non-ASCII character:

File "ql/cpp/ql/src/experimental/Security/CWE/CWE-377/InsecureTemporaryFile.ql" contains a non-ASCII character at the location marked with `|` in:
2021-11-04T21:45:50.6626257Z ```
2021-11-04T21:45:50.6626999Z etTarget().hasGlobalOrStdName("chmod")
2021-11-04T21:45:50.6627647Z   ) and
2021-11-04T21:45:50.6628063Z   msg =
2021-11-04T21:45:50.6628482Z     "|
2021-11-04T21:45:50.6628881Z ```

[ihsinme]

It's still complaining about a non-ASCII character:

File "ql/cpp/ql/src/experimental/Security/CWE/CWE-377/InsecureTemporaryFile.ql" contains a non-ASCII character at the location marked with `|` in:
2021-11-04T21:45:50.6626257Z ```
2021-11-04T21:45:50.6626999Z etTarget().hasGlobalOrStdName("chmod")
2021-11-04T21:45:50.6627647Z   ) and
2021-11-04T21:45:50.6628063Z   msg =
2021-11-04T21:45:50.6628482Z     "|
2021-11-04T21:45:50.6628881Z ```

please run the checks again.

[MathiasVP]

LGTM!