vuln-fix: Temporary File Information Disclosure

This fixes temporary file information disclosure vulnerability due to the use of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by using the `Files.createTempFile()` method which sets the correct posix permissions. Weakness: CWE-377: Insecure Temporary File Severity: Medium CVSSS: 5.5 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation) Reported-by: Jonathan Leitschuh <[email protected]> Signed-off-by: Jonathan Leitschuh <[email protected]> Bug-tracker: JLLeitschuh/security-research#18 Co-authored-by: Moderne <[email protected]>
BulkSecurityGeneratorProjectV2 · Nov 18, 2022 · c0498c2 · c0498c2
1 parent 2ce4cb9
commit c0498c2
Showing 1 changed file with 3 additions and 3 deletions.
diff --git a/src/test/java/org/apache/maven/shared/dependency/analyzer/ClassFileVisitorUtilsTest.java b/src/test/java/org/apache/maven/shared/dependency/analyzer/ClassFileVisitorUtilsTest.java
@@ -80,7 +80,7 @@ public void setUp()
     @Test
     public void testAcceptJar() throws IOException
     {
-        File file = File.createTempFile( "test", ".jar" );
+        File file = Files.createTempFile( "test", ".jar" ).toFile();
         file.deleteOnExit();
 
         try ( JarOutputStream out = new JarOutputStream( new FileOutputStream( file ) ) )
@@ -100,7 +100,7 @@ public void testAcceptJar() throws IOException
     @Test
     public void testAcceptJarWithNonClassEntry() throws IOException
     {
-        File file = File.createTempFile( "test", ".jar" );
+        File file = Files.createTempFile( "test", ".jar" ).toFile();
         file.deleteOnExit();
 
         try ( JarOutputStream out = new JarOutputStream( new FileOutputStream( file ) ) )
@@ -152,7 +152,7 @@ public void testAcceptDirWithNonClassFile() throws IOException
     @Test
     public void testAcceptWithFile() throws IOException
     {
-        File file = File.createTempFile( "test", ".class" );
+        File file = Files.createTempFile( "test", ".class" ).toFile();
         file.deleteOnExit();
 
         URL url = file.toURI().toURL();