MOTHBALLED-graphviz
MOTHBALLED-graphviz copied to clipboard
Insecure Temporary File
https://github.com/ellson/MOTHBALLED-graphviz/blob/ac239f71ea9f807590505e6862cebe50e992e271/lib/sparse/DotIO.c#L445
Good afternoon. I noticed in your code that the file is being generated, the filename is predictable and you are not setting the file permissions. this can be used to influence other files on the system (via temporary links) with the right to run your program. if it's important you need to use mkstemp or mkdtemp.