From e5105fc559b643ff1da914b1f060c42a4d0c0214 Mon Sep 17 00:00:00 2001 From: Jonathan Leitschuh Date: Fri, 18 Nov 2022 22:41:10 +0000 Subject: [PATCH] vuln-fix: Temporary File Information Disclosure This fixes temporary file information disclosure vulnerability due to the use of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by using the `Files.createTempFile()` method which sets the correct posix permissions. Weakness: CWE-377: Insecure Temporary File Severity: Medium CVSSS: 5.5 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation) Reported-by: Jonathan Leitschuh Signed-off-by: Jonathan Leitschuh Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18 Co-authored-by: Moderne --- .../asyncweb/fileservice/fileloader/MmapFileLoaderTest.java | 3 ++- .../asyncweb/fileservice/fileloader/SimpleFileLoaderTest.java | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/fileservice/src/test/java/org/apache/asyncweb/fileservice/fileloader/MmapFileLoaderTest.java b/fileservice/src/test/java/org/apache/asyncweb/fileservice/fileloader/MmapFileLoaderTest.java index d016219..530b0f7 100644 --- a/fileservice/src/test/java/org/apache/asyncweb/fileservice/fileloader/MmapFileLoaderTest.java +++ b/fileservice/src/test/java/org/apache/asyncweb/fileservice/fileloader/MmapFileLoaderTest.java @@ -4,6 +4,7 @@ import java.io.File; import java.io.FileOutputStream; +import java.nio.file.Files; import java.util.Random; import org.apache.asyncweb.fileservice.fileloader.FileLoader; @@ -18,7 +19,7 @@ public class MmapFileLoaderTest { @Test public void testLoadFile() throws Exception { // generate temp file - File tempFile=File.createTempFile("dummy",null); + File tempFile=Files.createTempFile("dummy", null).toFile(); tempFile.deleteOnExit(); FileOutputStream fos=new FileOutputStream(tempFile); Random rng=new Random(); diff --git a/fileservice/src/test/java/org/apache/asyncweb/fileservice/fileloader/SimpleFileLoaderTest.java b/fileservice/src/test/java/org/apache/asyncweb/fileservice/fileloader/SimpleFileLoaderTest.java index 46e6fc7..0695112 100644 --- a/fileservice/src/test/java/org/apache/asyncweb/fileservice/fileloader/SimpleFileLoaderTest.java +++ b/fileservice/src/test/java/org/apache/asyncweb/fileservice/fileloader/SimpleFileLoaderTest.java @@ -4,6 +4,7 @@ import java.io.File; import java.io.FileOutputStream; +import java.nio.file.Files; import java.util.Random; import org.apache.asyncweb.fileservice.fileloader.SimpleFileLoader; @@ -17,7 +18,7 @@ public class SimpleFileLoaderTest { @Test public void testLoadFile() throws Exception { // generate temp file - File tempFile=File.createTempFile("dummy",null); + File tempFile=Files.createTempFile("dummy", null).toFile(); tempFile.deleteOnExit(); FileOutputStream fos=new FileOutputStream(tempFile); Random rng=new Random();