{"action":"opened","issue":{"url":"https://api.github.com/repos/istio/istio/issues/8892","repository_url":"https://api.github.com/repos/istio/istio","labels_url":"https://api.github.com/repos/istio/istio/issues/8892/labels{/name}","comments_url":"https://api.github.com/repos/istio/istio/issues/8892/comments","events_url":"https://api.github.com/repos/istio/istio/issues/8892/events","html_url":"https://github.com/istio/istio/issues/8892","id":362424819,"node_id":"MDU6SXNzdWUzNjI0MjQ4MTk=","number":8892,"title":"[Security Vulnerability] : usage of /tmp directory as output","user":{"login":"Hamza2404","id":10462285,"node_id":"MDQ6VXNlcjEwNDYyMjg1","avatar_url":"https://avatars2.githubusercontent.com/u/10462285?v=4","gravatar_id":"","url":"https://api.github.com/users/Hamza2404","html_url":"https://github.com/Hamza2404","followers_url":"https://api.github.com/users/Hamza2404/followers","following_url":"https://api.github.com/users/Hamza2404/following{/other_user}","gists_url":"https://api.github.com/users/Hamza2404/gists{/gist_id}","starred_url":"https://api.github.com/users/Hamza2404/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Hamza2404/subscriptions","organizations_url":"https://api.github.com/users/Hamza2404/orgs","repos_url":"https://api.github.com/users/Hamza2404/repos","events_url":"https://api.github.com/users/Hamza2404/events{/privacy}","received_events_url":"https://api.github.com/users/Hamza2404/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":0,"created_at":"2018-09-21T01:32:12Z","updated_at":"2018-09-21T01:32:12Z","closed_at":null,"author_association":"NONE","body":"**Describe the feature request**\r\nbin\\istio-proxy-cfg.py:291\r\n291  `output_dir = \"/tmp/\" + pod.name`\r\n\r\nThere are a number of rules to follow when creating a temporary directory path.\r\nIt could a vulnerability for attackers to look for commonly hard-coding file paths starting with :\r\n- /tmp', '/var/tmp', '/dev/shm\r\n\r\n**Describe alternatives you've considered**\r\n- use [https://github.com/PyCQA/bandit](url) from @PyCQA as an alternative when bulding python application \r\n- cp files to another directory then reference back to the full path /.../tmp/ \r\n\r\n**Additional context**\r\nhttps://docs.openstack.org/developer/bandit/plugins/hardcoded_tmp_directory.html\r\n"}}
{"actor":{"display_login":"Hamza2404"}}