Description
upload_sarif_content() in src/main.rs:497-520 writes to a fixed predictable temp path cora-sarif-upload.json. Between create() and read, another process could replace the file contents (TOCTOU race).
Impact
- Concurrent cora runs could read each other's SARIF data
- Predictable filename in shared temp directory
Suggested Fix
Use random suffix or PID:
let tmp_path = tmp_dir.join(format!("cora-sarif-upload-{}.json", std::process::id()));Or use tempfile::NamedTempFile crate.
Description
upload_sarif_content()insrc/main.rs:497-520writes to a fixed predictable temp pathcora-sarif-upload.json. Betweencreate()andread, another process could replace the file contents (TOCTOU race).Impact
Suggested Fix
Use random suffix or PID:
Or use
tempfile::NamedTempFilecrate.