commit 1b0149fe42c2b0dda203ac2db38b2e171af3c4d2
author Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com> Fri Nov 18 22:46:37 2022 +0000
committer Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com> Fri Nov 18 22:46:37 2022 +0000
tree 54b3370ac44d03de04684df725acc254c1ccd3d2
parent 15ed4445758a4a86f5541b2e752ec221f166b2d1

vuln-fix: Temporary File Information Disclosure



This fixes temporary file information disclosure vulnerability due to the use
of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by
using the `Files.createTempFile()` method which sets the correct posix permissions.

Weakness: CWE-377: Insecure Temporary File
Severity: Medium
CVSSS: 5.5
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18


Co-authored-by: Moderne <team@moderne.io>

src/test/java/org/apache/sling/settings/impl/SlingSettingsServiceImplTest.java

diff --git a/src/test/java/org/apache/sling/settings/impl/SlingSettingsServiceImplTest.java b/src/test/java/org/apache/sling/settings/impl/SlingSettingsServiceImplTest.java
index e47bc46..cb6b063 100644
--- a/src/test/java/org/apache/sling/settings/impl/SlingSettingsServiceImplTest.java
+++ b/src/test/java/org/apache/sling/settings/impl/SlingSettingsServiceImplTest.java
@@ -27,6 +27,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.ObjectOutputStream;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.HashMap;
@@ -58,8 +59,8 @@
 
     @Before
     public void before() throws IOException {
-        slingIdFile = File.createTempFile(SLING_ID_FILE_NAME, "");
-        optionsFile = File.createTempFile(OPTIONS_FILE_NAME, "");
+        slingIdFile = Files.createTempFile(SLING_ID_FILE_NAME, "").toFile();
+        optionsFile = Files.createTempFile(OPTIONS_FILE_NAME, "").toFile();
         Converter c = Converters.standardConverter();
         // use standard configuration
         configuration = c.convert(new HashMap<String, Object>()).to(SlingSettingsServiceImpl.Configuration.class);