Google Git
Sign in
apache / maven-artifact-transfer / a4e008e9700be30c19914e04780fdbf10b35a65f
commita4e008e9700be30c19914e04780fdbf10b35a65f[log] [tgz]
authorJonathan Leitschuh <Jonathan.Leitschuh@gmail.com>Fri Nov 18 22:42:36 2022 +0000
committerSylwester Lachiewicz <slachiewicz@apache.org>Mon Mar 13 01:57:46 2023 +0100
treefbb18f7152478ca10abb16e2c780f3573efdf99b
parent0fda94bb1ba0a7dd304fd94e4288a2b294614f22 [diff]
vuln-fix: Temporary File Information Disclosure



This fixes temporary file information disclosure vulnerability due to the use
of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by
using the `Files.createTempFile()` method which sets the correct posix permissions.

Weakness: CWE-377: Insecure Temporary File
Severity: Medium
CVSSS: 5.5
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18


Co-authored-by: Moderne <team@moderne.io>
1 file changed
tree: fbb18f7152478ca10abb16e2c780f3573efdf99b
  1. .github/
  2. maven-3.0.x/
  3. maven-3.1.x/
  4. maven-artifact-transfer/
  5. maven-artifact-transfer-api/
  6. src/
  7. .asf.yaml
  8. .gitignore
  9. deploySite.sh
  10. Jenkinsfile
  11. pom.xml
  12. README.md
README.md

Contributing to Apache Maven Artifact Transfer

ASF Jira Apache License, Version 2.0, January 2004 Maven Central Jenkins Status Jenkins tests

You have found a bug or you have an idea for a cool new feature? Contributing code is a great way to give something back to the open source community. Before you dig right into the code, there are a few guidelines that we need contributors to follow so that we can have a chance of keeping on top of things.

Getting Started

  • Make sure you have a JIRA account.
  • Make sure you have a GitHub account.
  • If you‘re planning to implement a new feature, it makes sense to discuss your changes on the dev list first. This way you can make sure you’re not wasting your time on something that isn‘t considered to be in Apache Maven’s scope.
  • Submit a ticket for your issue, assuming one does not already exist.
    • Clearly describe the issue, including steps to reproduce when it is a bug.
    • Make sure you fill in the earliest version that you know has the issue.
  • Fork the repository on GitHub.

Making and Submitting Changes

We accept Pull Requests via GitHub. The developer mailing list is the main channel of communication for contributors.
There are some guidelines which will make applying PRs easier for us:

  • Create a topic branch from where you want to base your work (this is usually the master branch). Push your changes to a topic branch in your fork of the repository.
  • Make commits of logical units.
  • Respect the original code style: by using the same codestyle, patches should only highlight the actual difference, not being disturbed by any formatting issues:
    • Only use spaces for indentation.
    • Create minimal diffs - disable on save actions like reformat source code or organize imports. If you feel the source code should be reformatted, create a separate PR for this change.
    • Check for unnecessary whitespace with git diff --check before committing.
  • Make sure your commit messages are in the proper format. Your commit message should contain the key of the JIRA issue.
[MSHARED-XXX] - Subject of the JIRA Ticket
 Optional supplemental description.
  • Make sure you have added the necessary tests (JUnit/IT) for your changes.
  • Run all the tests with mvn -Prun-its verify to assure nothing else was accidentally broken.
  • Submit a pull request to the repository in the Apache organization.
  • Update your JIRA ticket and include a link to the pull request in the ticket.

If you plan to contribute on a regular basis, please consider filing a contributor license agreement.

Making Trivial Changes

For changes of a trivial nature to comments and documentation, it is not always necessary to create a new ticket in JIRA. In this case, it is appropriate to start the first line of a commit with ‘(doc)’ instead of a ticket number.

Additional Resources