From dfdb5c635bcbb371c081472b4f98f3b3e9a180cf Mon Sep 17 00:00:00 2001 From: Jonathan Leitschuh Date: Sat, 19 Nov 2022 21:26:36 +0000 Subject: [PATCH] vuln-fix: Temporary File Information Disclosure This fixes temporary file information disclosure vulnerability due to the use of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by using the `Files.createTempFile()` method which sets the correct posix permissions. Weakness: CWE-377: Insecure Temporary File Severity: Medium CVSSS: 5.5 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation) Reported-by: Jonathan Leitschuh Signed-off-by: Jonathan Leitschuh Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18 Co-authored-by: Moderne --- .../net/openhft/lang/io/examples/MappedStroreExampleMain.java | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) mode change 100755 => 100644 lang/src/test/java/net/openhft/lang/io/examples/MappedStroreExampleMain.java diff --git a/lang/src/test/java/net/openhft/lang/io/examples/MappedStroreExampleMain.java b/lang/src/test/java/net/openhft/lang/io/examples/MappedStroreExampleMain.java old mode 100755 new mode 100644 index 63dee5ff2..f4e04e830 --- a/lang/src/test/java/net/openhft/lang/io/examples/MappedStroreExampleMain.java +++ b/lang/src/test/java/net/openhft/lang/io/examples/MappedStroreExampleMain.java @@ -22,13 +22,14 @@ import java.io.File; import java.io.IOException; import java.nio.channels.FileChannel; +import java.nio.file.Files; /** * Created by peter.lawrey on 14/07/14. */ public class MappedStroreExampleMain { public static void main(String[] args) throws IOException { - File deleteme = File.createTempFile("deleteme", ".tmp"); + File deleteme = Files.createTempFile("deleteme", ".tmp").toFile(); deleteme.deleteOnExit(); // 4 GB of memory. long size = 4L << 30;