vuln-fix: Temporary File Information Disclosure

This fixes temporary file information disclosure vulnerability due to the use of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by using the `Files.createTempFile()` method which sets the correct posix permissions. Weakness: CWE-377: Insecure Temporary File Severity: Medium CVSSS: 5.5 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation) Reported-by: Jonathan Leitschuh <[email protected]> Signed-off-by: Jonathan Leitschuh <[email protected]> Bug-tracker: JLLeitschuh/security-research#18 Co-authored-by: Moderne <[email protected]>
chocoteam · Nov 28, 2022 · 3e84186 · 3e84186
1 parent aa01a34
commit 3e84186
Showing 1 changed file with 4 additions and 3 deletions.
diff --git a/solver/src/test/java/org/chocosolver/solver/search/loop/monitors/GephiNetworkTest.java b/solver/src/test/java/org/chocosolver/solver/search/loop/monitors/GephiNetworkTest.java
@@ -15,6 +15,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 
 /**
  * <p>
@@ -28,15 +29,15 @@ public class GephiNetworkTest {
     @Test(groups = "1s", timeOut = 60000)
     public void test1() throws IOException {
         Model s1 = ProblemMaker.makeCostasArrays(7);
-        File temp = File.createTempFile("tmp", ".gexf");
+        File temp = Files.createTempFile("tmp", ".gexf").toFile();
         s1.getSolver().constraintNetworkToGephi(temp.getAbsolutePath());
     }
 
     @Test(groups = "1s", timeOut = 60000)
     public void test2() throws IOException {
         Model s1 = ProblemMaker.makeGolombRuler(11);
-        File temp = File.createTempFile("tmp", ".gexf");
+        File temp = Files.createTempFile("tmp", ".gexf").toFile();
         s1.getSolver().constraintNetworkToGephi(temp.getAbsolutePath());
     }
 
-}
+}