vuln-fix: Temporary File Information Disclosure

This fixes temporary file information disclosure vulnerability due to the use of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by using the `Files.createTempFile()` method which sets the correct posix permissions. Weakness: CWE-377: Insecure Temporary File Severity: Medium CVSSS: 5.5 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation) Reported-by: Jonathan Leitschuh <[email protected]> Signed-off-by: Jonathan Leitschuh <[email protected]> Bug-tracker: JLLeitschuh/security-research#18 Co-authored-by: Moderne <[email protected]>
BulkSecurityGeneratorProjectV2 · Nov 18, 2022 · e5105fc · e5105fc
1 parent 81474b5
commit e5105fc
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 2 deletions.
diff --git a/fileservice/src/test/java/org/apache/asyncweb/fileservice/fileloader/MmapFileLoaderTest.java b/fileservice/src/test/java/org/apache/asyncweb/fileservice/fileloader/MmapFileLoaderTest.java
@@ -4,6 +4,7 @@
 
 import java.io.File;
 import java.io.FileOutputStream;
+import java.nio.file.Files;
 import java.util.Random;
 
 import org.apache.asyncweb.fileservice.fileloader.FileLoader;
@@ -18,7 +19,7 @@ public class MmapFileLoaderTest {
 	@Test
 	public void testLoadFile() throws Exception {
 		// generate temp file
-		File tempFile=File.createTempFile("dummy",null);
+		File tempFile=Files.createTempFile("dummy", null).toFile();
 		tempFile.deleteOnExit();
 		FileOutputStream fos=new FileOutputStream(tempFile);
 		Random rng=new Random();

diff --git a/...ervice/src/test/java/org/apache/asyncweb/fileservice/fileloader/SimpleFileLoaderTest.java b/...ervice/src/test/java/org/apache/asyncweb/fileservice/fileloader/SimpleFileLoaderTest.java
@@ -4,6 +4,7 @@
 
 import java.io.File;
 import java.io.FileOutputStream;
+import java.nio.file.Files;
 import java.util.Random;
 
 import org.apache.asyncweb.fileservice.fileloader.SimpleFileLoader;
@@ -17,7 +18,7 @@ public class SimpleFileLoaderTest {
 	@Test
 	public void testLoadFile() throws Exception {
 		// generate temp file
-		File tempFile=File.createTempFile("dummy",null);
+		File tempFile=Files.createTempFile("dummy", null).toFile();
 		tempFile.deleteOnExit();
 		FileOutputStream fos=new FileOutputStream(tempFile);
 		Random rng=new Random();