Fix symlink attack via predictable /tmp path in write_raw_config_to_disk

Cargo.toml

@@ -63,6 +63,7 @@ sha256 = "1.6.0"
 shellexpand = "3.1.2"
 strip-ansi-escapes = "0.2.1"
 strum = { version = "0.28", features = ["derive"] }
+tempfile = "3.27"
 thiserror = "2.0.18"
 time = { version = "0.3", features = ["macros", "formatting", "local-offset"] }
 tokio = { version = "1", features = ["full"] }
@@ -80,7 +81,6 @@ assert_cmd = "2.2.2"
 assert_fs = "1.1.4"
 nix = { version = "0.31", features = ["signal", "process"] }
 predicates = "3.1.4"
-tempfile = "3.27"
 wait-timeout = "0.2"
 
 [build-dependencies]

src/shared/config_load.rs

@@ -13,7 +13,7 @@ use serde_yaml::{Deserializer, Value};
 
 use std::collections::BTreeMap;
 use std::ffi::OsStr;
-use std::fs::{self, File};
+use std::fs;
 use std::io::Write;
 use std::path::{Path, PathBuf};
 use tracing::{debug, error, info, warn};
@@ -176,17 +176,18 @@ impl FoundConfig {
     pub fn write_raw_config_to_disk(&self) -> Result<PathBuf> {
         let json = serde_json::to_string(&self.raw_config)?;
         let json_bytes = json.as_bytes();
-        let file_path = PathBuf::from_iter(vec![
-            "/tmp",
-            "scope",
-            &format!("config-{}.json", self.run_id),
-        ]);
 
-        debug!("Merged config destination is to {}", file_path.display());
-
-        let mut file = File::create(&file_path)?;
+        fs::create_dir_all("/tmp/scope")?;
+        let mut file = tempfile::Builder::new()
+            .prefix("config-")
+            .suffix(".json")
+            .tempfile_in("/tmp/scope")?;
         file.write_all(json_bytes)?;
 
+        let (_, file_path) = file.keep()?;
+
+        debug!("Merged config destination is to {}", file_path.display());
+
         Ok(file_path)
     }