vuln-fix: Temporary File Information Disclosure

This fixes temporary file information disclosure vulnerability due to the use of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by using the `Files.createTempFile()` method which sets the correct posix permissions. Weakness: CWE-377: Insecure Temporary File Severity: Medium CVSSS: 5.5 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation) Reported-by: Jonathan Leitschuh <[email protected]> Signed-off-by: Jonathan Leitschuh <[email protected]> Bug-tracker: JLLeitschuh/security-research#18 Co-authored-by: Moderne <[email protected]>
LibrePDF · Apr 5, 2023 · e74c1c9 · e74c1c9
1 parent be7e7bd
commit e74c1c9
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 3 deletions.
diff --git a/openpdf/src/main/java/com/lowagie/text/pdf/PdfStamper.java b/openpdf/src/main/java/com/lowagie/text/pdf/PdfStamper.java
@@ -62,6 +62,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
+import java.nio.file.Files;
 import java.security.SignatureException;
 import java.security.cert.Certificate;
 import java.util.Calendar;
@@ -710,7 +711,7 @@ public static PdfStamper createSignature(PdfReader reader, OutputStream os, char
         }
         else {
             if (tempFile.isDirectory())
-                tempFile = File.createTempFile("pdf", null, tempFile);
+                tempFile = Files.createTempFile(tempFile.toPath(), "pdf", null).toFile();
             FileOutputStream fout = new FileOutputStream(tempFile);
             stp = new PdfStamper(reader, fout, pdfVersion, append);
             stp.sigApp = new PdfSignatureAppearance(stp.stamper);

diff --git a/openpdf/src/test/java/com/lowagie/text/pdf/LargePdfTest.java b/openpdf/src/test/java/com/lowagie/text/pdf/LargePdfTest.java
@@ -8,6 +8,7 @@
 
 import java.io.File;
 import java.io.FileOutputStream;
+import java.nio.file.Files;
 
 /**
  * This will create a file which is ~14GB, then attempt to read it.
@@ -20,7 +21,7 @@ public class LargePdfTest {
     @Disabled
     @Test
     void writeLargePdf() throws Exception {
-        File largeFile = File.createTempFile("largePDFFile", ".pdf");
+        File largeFile = Files.createTempFile("largePDFFile", ".pdf").toFile();
         Document document = PdfTestBase.createPdf(
                 new FileOutputStream(largeFile));
 

diff --git a/openpdf/src/test/java/com/lowagie/text/pdf/SimplePdfTest.java b/openpdf/src/test/java/com/lowagie/text/pdf/SimplePdfTest.java
@@ -2,6 +2,7 @@
 
 import java.io.File;
 import java.io.FileOutputStream;
+import java.nio.file.Files;
 
 import org.junit.jupiter.api.Test;
 
@@ -34,7 +35,7 @@ void testSimplePdf() throws Exception {
     @Test
     void testTryWithResources_with_os_before_doc() throws Exception {
         try (PdfReader reader = new PdfReader("./src/test/resources/HelloWorldMeta.pdf");
-            FileOutputStream os = new FileOutputStream(File.createTempFile("temp-file-name", ".pdf"));
+            FileOutputStream os = new FileOutputStream(Files.createTempFile("temp-file-name", ".pdf").toFile());
              Document document = new Document()
         ) {
             PdfWriter writer = PdfWriter.getInstance(document, os);