vuln-fix: Temporary File Information Disclosure (#1125)
This fixes temporary file information disclosure vulnerability due to the use
of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by
using the `Files.createTempFile()` method which sets the correct posix permissions.
Weakness: CWE-377: Insecure Temporary File
Severity: Medium
CVSSS: 5.5
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)
Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18
Co-authored-by: Moderne <team@moderne.io>
diff --git a/modules/integration-tests/src/main/java/org/apache/fluo/integration/impl/StochasticBankIT.java b/modules/integration-tests/src/main/java/org/apache/fluo/integration/impl/StochasticBankIT.java
index 192ca01..d9c779d 100644
--- a/modules/integration-tests/src/main/java/org/apache/fluo/integration/impl/StochasticBankIT.java
+++ b/modules/integration-tests/src/main/java/org/apache/fluo/integration/impl/StochasticBankIT.java
@@ -19,6 +19,7 @@
import java.io.File;
import java.io.FileWriter;
import java.io.Writer;
+import java.nio.file.Files;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
@@ -252,7 +253,7 @@
log.debug("start times : " + lastTx.getStartTs() + " " + tx.getStartTs());
log.debug("sum1 : %,d sum2 : %,d diff : %,d\n", sum1, sum2, sum2 - sum1);
- File tmpFile = File.createTempFile("sb_dump", ".txt");
+ File tmpFile = Files.createTempFile("sb_dump", ".txt").toFile();
Writer fw = new BufferedWriter(new FileWriter(tmpFile));
Scanner scanner =
