SONARPY-3115: Rule S7620: AWS Lambda functions should clean up temporary files before completing invocation (#418)

joke1196 · sonartech · commit a5f85b3bcff7 · 2025-08-07T07:46:50.000Z
GitOrigin-RevId: c8f1b20c3c65c2ca04c5ef2630b9991ca7be2ab1
diff --git a/python-checks/src/main/java/org/sonar/python/checks/AwsLambdaTmpCleanupCheck.java b/python-checks/src/main/java/org/sonar/python/checks/AwsLambdaTmpCleanupCheck.java
@@ -0,0 +1,155 @@
+/*
+ * SonarQube Python Plugin
+ * Copyright (C) 2011-2025 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the Sonar Source-Available License for more details.
+ *
+ * You should have received a copy of the Sonar Source-Available License
+ * along with this program; if not, see https://sonarsource.com/license/ssal/
+ */
+package org.sonar.python.checks;
+
+import java.util.regex.Pattern;
+import java.util.stream.Stream;
+import javax.annotation.Nullable;
+import org.sonar.check.Rule;
+import org.sonar.plugins.python.api.PythonSubscriptionCheck;
+import org.sonar.plugins.python.api.SubscriptionContext;
+import org.sonar.plugins.python.api.tree.CallExpression;
+import org.sonar.plugins.python.api.tree.Expression;
+import org.sonar.plugins.python.api.tree.FunctionDef;
+import org.sonar.plugins.python.api.tree.Name;
+import org.sonar.plugins.python.api.tree.RegularArgument;
+import org.sonar.plugins.python.api.tree.StringLiteral;
+import org.sonar.plugins.python.api.tree.Tree;
+import org.sonar.python.checks.utils.AwsLambdaChecksUtils;
+import org.sonar.python.checks.utils.Expressions;
+import org.sonar.python.semantic.v2.SymbolV2;
+import org.sonar.python.semantic.v2.UsageV2;
+import org.sonar.python.tree.TreeUtils;
+import org.sonar.python.types.v2.TypeCheckBuilder;
+
+@Rule(key = "S7620")
+public class AwsLambdaTmpCleanupCheck extends PythonSubscriptionCheck {
+
+  private static final String MESSAGE = "Clean up this temporary file before the Lambda function completes.";
+  private static final String SECONDARY_LOCATION_MESSAGE = "The temporary folder is used in this Lambda function.";
+  private static final Pattern TMP_PATH_PATTERN = Pattern.compile("^/tmp/.*");
+
+  private TypeCheckBuilder openType;
+  private TypeCheckBuilder osRemoveType;
+  private TypeCheckBuilder osUnlinkType;
+
+  @Override
+  public void initialize(Context context) {
+    context.registerSyntaxNodeConsumer(Tree.Kind.FILE_INPUT, this::initializeTypeChecker);
+    context.registerSyntaxNodeConsumer(Tree.Kind.CALL_EXPR, this::visitCallExpression);
+  }
+
+  private void initializeTypeChecker(SubscriptionContext ctx) {
+    openType = ctx.typeChecker().typeCheckBuilder().isBuiltinWithName("open");
+    osRemoveType = ctx.typeChecker().typeCheckBuilder().isTypeWithFqn("os.remove");
+    osUnlinkType = ctx.typeChecker().typeCheckBuilder().isTypeWithFqn("os.unlink");
+  }
+
+  private void visitCallExpression(SubscriptionContext ctx) {
+    CallExpression callExpression = (CallExpression) ctx.syntaxNode();
+
+    Tree functionDefAncestor = TreeUtils.firstAncestorOfKind(callExpression, Tree.Kind.FUNCDEF);
+    if (functionDefAncestor == null) {
+      return;
+    }
+
+    FunctionDef lambdaHandler = (FunctionDef) functionDefAncestor;
+
+    if (!AwsLambdaChecksUtils.isLambdaHandler(ctx, lambdaHandler)) {
+      return;
+    }
+
+    if (openType.check(callExpression.callee().typeV2()).isTrue() && !isTempFileCleanedUp(callExpression, lambdaHandler)) {
+      ctx.addIssue(callExpression.callee(), MESSAGE)
+        .secondary(lambdaHandler.name(), SECONDARY_LOCATION_MESSAGE);
+    }
+  }
+
+  private boolean isTempFileCleanedUp(CallExpression callExpression, FunctionDef lambdaHandler) {
+    RegularArgument regularArg = TreeUtils.nthArgumentOrKeyword(0, "file", callExpression.arguments());
+
+    if (regularArg == null) {
+      return true;
+    }
+
+    Expression pathExpression = regularArg.expression();
+    String pathValue = getStringValue(pathExpression);
+
+    return pathValue == null ||
+      !TMP_PATH_PATTERN.matcher(pathValue).matches() ||
+      hasCleanupCall(lambdaHandler, pathValue) ||
+      isPathPassedToOtherFunction(pathExpression);
+  }
+
+  private boolean isPathPassedToOtherFunction(Expression pathExpression) {
+    if (!(pathExpression instanceof Name)) {
+      return true;
+    }
+    Name name = (Name) pathExpression;
+    SymbolV2 symbol = name.symbolV2();
+    if (symbol == null) {
+      return true;
+    }
+    return getUsagesInCallExpr(symbol)
+      .anyMatch(callExpr -> !isOsRemoveOrUnlinkCall(callExpr) && !openType.check(callExpr.callee().typeV2()).isTrue());
+
+  }
+
+  private static Stream<CallExpression> getUsagesInCallExpr(SymbolV2 symbol) {
+    return symbol.usages().stream()
+      .filter(usage -> usage.kind().equals(UsageV2.Kind.OTHER))
+      .map(usage -> usage.tree().parent())
+      .filter(parent -> parent.is(Tree.Kind.REGULAR_ARGUMENT))
+      .map(parent -> TreeUtils.firstAncestorOfKind(parent, Tree.Kind.CALL_EXPR))
+      .flatMap(TreeUtils.toStreamInstanceOfMapper(CallExpression.class));
+  }
+
+  private boolean hasCleanupCall(FunctionDef function, String filePath) {
+    return TreeUtils.firstChild(function, child -> child instanceof CallExpression callExpr && isOsRemoveOrUnlinkCall(callExpr) && hasMatchingPath(callExpr, filePath)).isPresent();
+  }
+
+  private boolean isOsRemoveOrUnlinkCall(CallExpression callExpression) {
+    return osRemoveType.check(callExpression.callee().typeV2()).isTrue() ||
+      osUnlinkType.check(callExpression.callee().typeV2()).isTrue();
+  }
+
+  private static boolean hasMatchingPath(CallExpression call, String targetPath) {
+    RegularArgument regularArg = TreeUtils.nthArgumentOrKeyword(0, "path", call.arguments());
+
+    if (regularArg == null) {
+      return false;
+    }
+
+    String pathValue = getStringValue(regularArg.expression());
+    return targetPath.equals(pathValue);
+  }
+
+  @Nullable
+  private static String getStringValue(Expression expression) {
+    if (expression instanceof StringLiteral stringLiteral) {
+      return stringLiteral.trimmedQuotesValue();
+    }
+    if (expression instanceof Name name) {
+      var assignedValue = Expressions.singleAssignedValue(name);
+      if (assignedValue instanceof StringLiteral stringLiteral) {
+        return stringLiteral.trimmedQuotesValue();
+      }
+    }
+    return null;
+  }
+
+}
diff --git a/python-checks/src/main/java/org/sonar/python/checks/OpenSourceCheckList.java b/python-checks/src/main/java/org/sonar/python/checks/OpenSourceCheckList.java
@@ -133,6 +133,7 @@ public Stream<Class<?>> getChecks() {
       AwsLambdaCrossCallCheck.class,
       AwsLambdaReservedEnvironmentVariableCheck.class,
       AwsLambdaReturnValueAreSerializableCheck.class,
+      AwsLambdaTmpCleanupCheck.class,
       AwsMissingPaginationCheck.class,
       AwsWaitersInsteadOfCustomPollingCheck.class,
       BackslashInStringCheck.class,
diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S7620.html b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S7620.html
@@ -0,0 +1,34 @@
+<p>This rule raises an issue when AWS Lambda handlers write to the /tmp directory without properly cleaning up temporary files before function
+completion.</p>
+<h2>Why is this an issue?</h2>
+<p>AWS Lambda provides a temporary file system at /tmp for each execution environment. However, the contents of /tmp can persist across multiple
+invocations of the same Lambda function instance during "warm starts." When temporary files are not cleaned up, they remain available to subsequent
+invocations of the same function instance.</p>
+<h3>What is the potential impact?</h3>
+<p>This can lead to serious security and reliability issues: sensitive data from one invocation might leak to unrelated subsequent invocations, disk
+space can be exhausted causing function failures, and stale data from previous runs can cause unexpected behavior and hard-to-debug issues.</p>
+<h3>Exceptions</h3>
+<ul>
+  <li> Writing to /tmp is recommended for caching data used by future lambda invocations. </li>
+</ul>
+<h2>How to fix it</h2>
+<p>Always clean up temporary files before your Lambda function completes. It is possible to use the <code>tempfile</code> module to create temporary
+files that will be automatically deleted.</p>
+<p>Otherwise, use a <code>try…​finally</code> block to ensure cleanup happens even if errors occur during processing.</p>
+<h3>Code examples</h3>
+<h4>Noncompliant code example</h4>
+<pre data-diff-id="1" data-diff-type="noncompliant">
+def lambda_handler(event, context):
+    file_path = '/tmp/temp_data.txt'  # Noncompliant
+    with open(file_path, 'w') as f:
+        f.write("Something")
+</pre>
+<h4>Compliant solution</h4>
+<pre data-diff-id="1" data-diff-type="compliant">
+import tempfile
+
+def lambda_handler(event, context):
+    with tempfile.NamedTemporaryFile() as f:  # Compliant
+        f.write("Something")
+</pre>
+
diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S7620.json b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/S7620.json
@@ -0,0 +1,24 @@
+{
+  "title": "AWS Lambda handlers should clean up temporary files in \/tmp directory",
+  "type": "BUG",
+  "status": "ready",
+  "remediation": {
+    "func": "Constant\/Issue",
+    "constantCost": "5min"
+  },
+  "tags": [
+    "aws",
+    "lambda"
+  ],
+  "defaultSeverity": "Major",
+  "ruleSpecification": "RSPEC-7620",
+  "sqKey": "S7620",
+  "scope": "Main",
+  "quickfix": "unknown",
+  "code": {
+    "impacts": {
+      "RELIABILITY": "MEDIUM"
+    },
+    "attribute": "COMPLETE"
+  }
+}
diff --git a/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/Sonar_way_profile.json b/python-checks/src/main/resources/org/sonar/l10n/py/rules/python/Sonar_way_profile.json
@@ -295,6 +295,7 @@
     "S7618",
     "S7621",
     "S7622",
+    "S7620",
     "S7632"
   ]
 }
diff --git a/python-checks/src/test/java/org/sonar/python/checks/AwsLambdaTmpCleanupCheckTest.java b/python-checks/src/test/java/org/sonar/python/checks/AwsLambdaTmpCleanupCheckTest.java
@@ -0,0 +1,30 @@
+/*
+ * SonarQube Python Plugin
+ * Copyright (C) 2011-2025 SonarSource SA
+ * mailto:info AT sonarsource DOT com
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the Sonar Source-Available License Version 1, as published by SonarSource SA.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ * See the Sonar Source-Available License for more details.
+ *
+ * You should have received a copy of the Sonar Source-Available License
+ * along with this program; if not, see https://sonarsource.com/license/ssal/
+ */
+package org.sonar.python.checks;
+
+import org.junit.jupiter.api.Test;
+import org.sonar.python.checks.utils.PythonCheckVerifier;
+
+class AwsLambdaTmpCleanupCheckTest {
+
+  @Test
+  void test() {
+    PythonCheckVerifier.verify("src/test/resources/checks/awsLambdaTmpCleanup.py", new AwsLambdaTmpCleanupCheck());
+  }
+
+}
+
diff --git a/python-checks/src/test/resources/checks/awsLambdaTmpCleanup.py b/python-checks/src/test/resources/checks/awsLambdaTmpCleanup.py
@@ -0,0 +1,109 @@
+import os
+import tempfile
+
+# Lambda handler - non-compliant cases
+def with_open_lambda_handler(event, context): 
+#   ^^^^^^^^^^^^^^^^^^^^^^^^> {{The temporary folder is used in this Lambda function.}}
+    file_path = '/tmp/temp_data.txt'
+    with open(file_path, 'w') as f:  # Noncompliant {{Clean up this temporary file before the Lambda function completes.}}
+    #    ^^^^
+        f.write("Something")
+
+def open_lambda_handler(event, context):  
+    file_path = '/tmp/another_file.txt'
+    f = open(file_path, 'w')  # Noncompliant
+    f.write("Data")
+    f.close()
+
+def os_remove_other_path_lambda_handler(event, context):
+    file_path = '/tmp/temp_data.txt'
+    with open(file_path, 'w') as f: # Noncompliant
+        f.write("Something")
+    os.remove("somefile.txt")
+
+def os_unlink_no_path_lambda_handler(event, context):
+    file_path = '/tmp/temp_data.txt'
+    with open(file_path, 'w') as f: # Noncompliant
+        f.write("Something")
+    os.unlink()
+
+
+
+# Lambda handler - compliant cases
+def os_remove_lambda_handler(event, context):
+    file_path = '/tmp/temp_data.txt'
+    with open(file_path, 'w') as f:
+        f.write("Something")
+    os.remove(file_path)
+
+
+def cleanup_in_other_function_lambda_handler(event, context):
+    clean_up_path = '/tmp/temp_data.txt'
+    with open(clean_up_path, 'w') as f: 
+        f.write("Something")
+    cleanup(clean_up_path) 
+
+def cleanup(file_path):
+    os.unlink(file_path)
+
+def incorrect_cleanup_lambda_handler(event, context):
+    clean_up_path = '/tmp/temp_data.txt'
+    with open(clean_up_path, 'w') as f:  # FN as we stop the check once the file path is passed to a function
+        f.write("Something")
+    incorrect_cleanup(clean_up_path) 
+
+def incorrect_cleanup(file_path):
+    return file_path
+
+def os_unlink_lambda_handler(event, context):
+    # Compliant: /tmp file with proper cleanup using os.unlink
+    file_path = '/tmp/temp_data.txt'
+    f = open(file_path, 'w')
+    f.write("Data")
+    f.close()
+    os.unlink(file_path)
+
+
+def tempfile_lambda_handler(event, context):
+    with tempfile.TemporaryFile() as temp_file:
+        temp_file.write(b"Some data")
+
+# Lambda handler with non-/tmp paths - should not trigger
+def not_tmp_lambda_handler(event, context):
+    # Compliant: not writing to /tmp
+    file_path = '/var/log/app.log'
+    with open(file_path, 'w') as f:
+        f.write("Log data")
+
+# Non-lambda functions - should not trigger issues
+def regular_function():
+    file_path = '/tmp/temp_data.txt'
+    with open(file_path, 'w') as f:
+        f.write("Something")
+
+
+# =============== Coverage =================
+
+
+def no_path_lambda_handler(event, context):
+    with open() as f:
+        f.write("Log data")
+
+def not_string_path_lambda_handler(event, context):
+    with open(2, 'w') as f:
+        f.write("Log data")
+
+def not_string_var_path_lambda_handler(event, context):
+    file_path = 2
+    with open(file_path, 'w') as f:
+        f.write("Log data")
+
+def different_string_lambda_handler(event, context):
+    with open("/tmp/file.txt", 'w') as f: 
+        f.write("Something")
+    os.remove("/tmp/other_file.txt") 
+
+def same_string_lambda_handler(event, context):
+    with open("/tmp/file.txt", 'w') as f: 
+        f.write("Something")
+    os.remove("/tmp/file.txt") 

Original file line number	Diff line number	Diff line change
`@@ -295,6 +295,7 @@`
`295`	`295`	`"S7618",`
`296`	`296`	`"S7621",`
`297`	`297`	`"S7622",`
	`298`	`+ "S7620",`
`298`	`299`	`"S7632"`
`299`	`300`	`]`
`300`	`301`	`}`