vuln-fix: Temporary Directory Hijacking or Information Disclosure (#152)

This fixes either Temporary Directory Hijacking, or Temporary Directory Local Information Disclosure. Weakness: CWE-379: Creation of Temporary File in Directory with Insecure Permissions Severity: High CVSSS: 7.3 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.UseFilesCreateTempDirectory) Reported-by: Jonathan Leitschuh <[email protected]> Bug-tracker: JLLeitschuh/security-research#10 Co-authored-by: Moderne <[email protected]>
jenkinsci · Mar 21, 2023 · d179702 · d179702
1 parent f5856bd
commit d179702
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 21 deletions.
diff --git a/...t/java/com/google/jenkins/plugins/credentials/oauth/JsonServiceAccountConfigTestUtil.java b/...t/java/com/google/jenkins/plugins/credentials/oauth/JsonServiceAccountConfigTestUtil.java
@@ -22,6 +22,7 @@
 import java.io.IOException;
 import java.io.StringWriter;
 import java.nio.charset.Charset;
+import java.nio.file.Files;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.NoSuchAlgorithmException;
@@ -64,13 +65,7 @@ public static String createTempJsonKeyFile(String clientEmail, PrivateKey privat
 
  private static File getTempFolder() throws IOException {
  if (tempFolder == null) {
- tempFolder = File.createTempFile("temp", Long.toString(System.nanoTime()));
- if (!tempFolder.delete()) {
- throw new IOException("Could not delete temp file: " + tempFolder.getAbsolutePath());
- }
- if (!tempFolder.mkdir()) {
- throw new IOException("Could not create temp directory: " + tempFolder.getAbsolutePath());
- }
+ tempFolder = Files.createTempDirectory("temp" + Long.toString(System.nanoTime())).toFile();
  tempFolder.deleteOnExit();
  }
  return tempFolder;

diff --git a/...java/com/google/jenkins/plugins/credentials/oauth/LegacyJsonServiceAccountConfigUtil.java b/...java/com/google/jenkins/plugins/credentials/oauth/LegacyJsonServiceAccountConfigUtil.java
@@ -21,6 +21,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.nio.charset.Charset;
+import java.nio.file.Files;
 
 /**
  * Util class for {@link com.google.jenkins.plugins.credentials.oauth
@@ -86,13 +87,7 @@ public static String createTempInvalidLegacyJsonKeyFile() throws IOException {
 
  private static File getTempFolder() throws IOException {
  if (tempFolder == null) {
- tempFolder = File.createTempFile("temp", Long.toString(System.nanoTime()));
- if (!tempFolder.delete()) {
- throw new IOException("Could not delete temp file: " + tempFolder.getAbsolutePath());
- }
- if (!tempFolder.mkdir()) {
- throw new IOException("Could not create temp directory: " + tempFolder.getAbsolutePath());
- }
+ tempFolder = Files.createTempDirectory("temp" + Long.toString(System.nanoTime())).toFile();
  tempFolder.deleteOnExit();
  }
  return tempFolder;

diff --git a/...st/java/com/google/jenkins/plugins/credentials/oauth/P12ServiceAccountConfigTestUtil.java b/...st/java/com/google/jenkins/plugins/credentials/oauth/P12ServiceAccountConfigTestUtil.java
@@ -19,6 +19,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.math.BigInteger;
+import java.nio.file.Files;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.KeyStore;
@@ -64,13 +65,7 @@ public static String createTempP12KeyFile(KeyPair keyPair)
 
  private static File getTempFolder() throws IOException {
  if (tempFolder == null) {
- tempFolder = File.createTempFile("temp", Long.toString(System.nanoTime()));
- if (!tempFolder.delete()) {
- throw new IOException("Could not delete temp file: " + tempFolder.getAbsolutePath());
- }
- if (!tempFolder.mkdir()) {
- throw new IOException("Could not create temp directory: " + tempFolder.getAbsolutePath());
- }
+ tempFolder = Files.createTempDirectory("temp" + Long.toString(System.nanoTime())).toFile();
  tempFolder.deleteOnExit();
  }
  return tempFolder;