From d867ec28c7db79091b9d41286c45668ec3d19452 Mon Sep 17 00:00:00 2001 From: Jonathan Leitschuh Date: Sat, 19 Nov 2022 02:10:04 +0000 Subject: [PATCH] vuln-fix: Temporary File Information Disclosure This fixes temporary file information disclosure vulnerability due to the use of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by using the `Files.createTempFile()` method which sets the correct posix permissions. Weakness: CWE-377: Insecure Temporary File Severity: Medium CVSSS: 5.5 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation) Reported-by: Jonathan Leitschuh Signed-off-by: Jonathan Leitschuh Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18 Co-authored-by: Moderne --- .../com/indeed/proctor/webapp/db/GitProctorStoreFactory.java | 3 ++- .../com/indeed/proctor/webapp/db/SvnProctorStoreFactory.java | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/proctor-webapp-library/src/main/java/com/indeed/proctor/webapp/db/GitProctorStoreFactory.java b/proctor-webapp-library/src/main/java/com/indeed/proctor/webapp/db/GitProctorStoreFactory.java index 3f6a566fb..72737cb4f 100644 --- a/proctor-webapp-library/src/main/java/com/indeed/proctor/webapp/db/GitProctorStoreFactory.java +++ b/proctor-webapp-library/src/main/java/com/indeed/proctor/webapp/db/GitProctorStoreFactory.java @@ -18,6 +18,7 @@ import javax.annotation.Nullable; import java.io.File; import java.io.IOException; +import java.nio.file.Files; import java.util.concurrent.ScheduledExecutorService; public class GitProctorStoreFactory implements TrunkQaProdStoresFactory { @@ -190,7 +191,7 @@ private File createTempDirectoryForPath(final String relativePath) { * @return */ private File identifyImplicitTempRoot() throws IOException { - final File tempFile = File.createTempFile("implicit", GitProctorStoreFactory.class.getSimpleName()); + final File tempFile = Files.createTempFile("implicit", GitProctorStoreFactory.class.getSimpleName()).toFile(); tempFile.delete(); return tempFile.getParentFile(); diff --git a/proctor-webapp-library/src/main/java/com/indeed/proctor/webapp/db/SvnProctorStoreFactory.java b/proctor-webapp-library/src/main/java/com/indeed/proctor/webapp/db/SvnProctorStoreFactory.java index fa292fe3c..5f2c827e0 100644 --- a/proctor-webapp-library/src/main/java/com/indeed/proctor/webapp/db/SvnProctorStoreFactory.java +++ b/proctor-webapp-library/src/main/java/com/indeed/proctor/webapp/db/SvnProctorStoreFactory.java @@ -16,6 +16,7 @@ import java.io.File; import java.io.IOException; +import java.nio.file.Files; import java.util.concurrent.ScheduledExecutorService; import java.util.concurrent.TimeUnit; @@ -116,7 +117,7 @@ public ProctorStore createStore(final String relativePath) { * @return */ private File identifyImplicitTempRoot() throws IOException { - final File tempFile = File.createTempFile("implicit", SvnProctorStoreFactory.class.getSimpleName()); + final File tempFile = Files.createTempFile("implicit", SvnProctorStoreFactory.class.getSimpleName()).toFile(); tempFile.delete(); return tempFile.getParentFile();