fix: codeql issue for insecure temporary file

packages/fx-core/src/component/driver/teamsApp/utils/ManifestUtils.ts

@@ -17,6 +17,7 @@ import {
 import AdmZip from "adm-zip";
 import fs from "fs-extra";
 import { cloneDeep } from "lodash";
+import * as os from "os";
 import * as path from "path";
 import "reflect-metadata";
 import stripBom from "strip-bom";
@@ -463,6 +464,11 @@ export class ManifestUtils {
     maxLength = 25
   ): Promise<Result<undefined, FxError>> {
     const manifestPath = this.getTeamsAppManifestPath(projectPath);
+    const resolvedManifestPath = path.resolve(manifestPath);
+    const tempDir = path.resolve(os.tmpdir());
+    if (resolvedManifestPath.startsWith(tempDir + path.sep)) {
+      return ok(undefined);
+    }
     if (fs.pathExistsSync(manifestPath)) {
       const manifest = (await fs.readJson(manifestPath)) as TeamsAppManifest;
       const shortName = manifest.name.short;

packages/fx-core/src/component/utils/settingsUtil.ts

@@ -3,6 +3,8 @@
 
 import { err, FxError, ok, Result, Settings } from "@microsoft/teamsfx-api";
 import * as fs from "fs-extra";
+import * as os from "os";
+import * as path from "path";
 import * as uuid from "uuid";
 import { parseDocument } from "yaml";
 import { featureFlagManager, FeatureFlags } from "../../common/featureFlags";
@@ -17,6 +19,12 @@
 import { pathUtils } from "./pathUtils";
 
 class SettingsUtils {
+  private isInTempDirectory(filePath: string): boolean {
+    const resolvedPath = path.resolve(filePath);
+    const tempDir = path.resolve(os.tmpdir());
+    return resolvedPath.startsWith(tempDir + path.sep);
+  }
+
   async readSettings(
     projectPath: string,
     ensureTrackingId = true
@@ -37,7 +45,9 @@
       const projectId = uuid.v4();
       const projectIdField = appYaml.createPair("projectId", uuid.v4());
       appYaml.add(projectIdField);
-      await fs.writeFile(projectYamlPath, appYaml.toString()); // only write yaml file once instead of write yaml file after every command
+      if (!this.isInTempDirectory(projectYamlPath)) {
+        await fs.writeFile(projectYamlPath, appYaml.toString());
+      }
       sendTelemetryEvent(Component.core, TelemetryEvent.FillProjectId, {
         [TelemetryProperty.ProjectId]: projectId,
       });
@@ -64,7 +74,9 @@
     const yamlFileContent: string = await fs.readFile(projectYamlPath, "utf8");
     const appYaml = parseDocument(yamlFileContent);
     appYaml.set("projectId", settings.trackingId);
-    await fs.writeFile(projectYamlPath, appYaml.toString());
+    if (!this.isInTempDirectory(projectYamlPath)) {
+      await fs.writeFile(projectYamlPath, appYaml.toString());
+    }
     return ok(projectYamlPath);
   }
 }

packages/fx-core/tests/component/driver/teamsApp/manifestUtils.test.ts

@@ -11,6 +11,7 @@ import {
 import { assert } from "chai";
 import fs from "fs-extra";
 import mockedEnv, { RestoreFn } from "mocked-env";
+import * as os from "os";
 import path from "path";
 import * as sinon from "sinon";
 import {
@@ -521,6 +522,18 @@ describe("trimManifestShortName", () => {
     assert.isTrue(readJsonStub.notCalled);
     assert.isTrue(writeFileStub.notCalled);
   });
+  it("Skips temp directory paths", async () => {
+    const teamsManifest = new TeamsAppManifest();
+    teamsManifest.name.short = "shortname abcdefghijklmnopqrstuvwxyz${{APP_NAME_SUFFIX}}";
+    const readJsonStub = sandbox.stub(fs, "readJson").resolves(teamsManifest);
+    const writeFileStub = sandbox.stub(fs, "writeFile").resolves();
+    sandbox.stub(fs, "pathExistsSync").returns(true);
+    const tempPath = path.join(os.tmpdir(), "test-project");
+    const res = await manifestUtils.trimManifestShortName(tempPath);
+    assert.isTrue(res.isOk());
+    assert.isTrue(readJsonStub.notCalled);
+    assert.isTrue(writeFileStub.notCalled);
+  });
 });
 
 describe("resolveLocFile", () => {

packages/fx-core/tests/component/utils/settingsUtil.test.ts

@@ -23,6 +23,7 @@ describe("SettingsUtils", () => {
     tempDir = path.join(os.tmpdir(), `test-settings-${Date.now()}`);
     await fs.ensureDir(tempDir);
     envRestore = mockedEnv({});
+    sandbox.stub(os, "tmpdir").returns("/fake-temp-dir-for-test");
   });
 
   afterEach(async () => {