From c0498c21bc334490f57634234796157b7f8cbf61 Mon Sep 17 00:00:00 2001 From: Jonathan Leitschuh Date: Fri, 18 Nov 2022 22:41:11 +0000 Subject: [PATCH] vuln-fix: Temporary File Information Disclosure This fixes temporary file information disclosure vulnerability due to the use of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by using the `Files.createTempFile()` method which sets the correct posix permissions. Weakness: CWE-377: Insecure Temporary File Severity: Medium CVSSS: 5.5 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation) Reported-by: Jonathan Leitschuh Signed-off-by: Jonathan Leitschuh Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18 Co-authored-by: Moderne --- .../dependency/analyzer/ClassFileVisitorUtilsTest.java | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/test/java/org/apache/maven/shared/dependency/analyzer/ClassFileVisitorUtilsTest.java b/src/test/java/org/apache/maven/shared/dependency/analyzer/ClassFileVisitorUtilsTest.java index e1d1f878..f66fedec 100644 --- a/src/test/java/org/apache/maven/shared/dependency/analyzer/ClassFileVisitorUtilsTest.java +++ b/src/test/java/org/apache/maven/shared/dependency/analyzer/ClassFileVisitorUtilsTest.java @@ -80,7 +80,7 @@ public void setUp() @Test public void testAcceptJar() throws IOException { - File file = File.createTempFile( "test", ".jar" ); + File file = Files.createTempFile( "test", ".jar" ).toFile(); file.deleteOnExit(); try ( JarOutputStream out = new JarOutputStream( new FileOutputStream( file ) ) ) @@ -100,7 +100,7 @@ public void testAcceptJar() throws IOException @Test public void testAcceptJarWithNonClassEntry() throws IOException { - File file = File.createTempFile( "test", ".jar" ); + File file = Files.createTempFile( "test", ".jar" ).toFile(); file.deleteOnExit(); try ( JarOutputStream out = new JarOutputStream( new FileOutputStream( file ) ) ) @@ -152,7 +152,7 @@ public void testAcceptDirWithNonClassFile() throws IOException @Test public void testAcceptWithFile() throws IOException { - File file = File.createTempFile( "test", ".class" ); + File file = Files.createTempFile( "test", ".class" ).toFile(); file.deleteOnExit(); URL url = file.toURI().toURL();