vuln-fix: Temporary File Information Disclosure

This fixes temporary file information disclosure vulnerability due to the use of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by using the `Files.createTempFile()` method which sets the correct posix permissions. Weakness: CWE-377: Insecure Temporary File Severity: Medium CVSSS: 5.5 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation) Reported-by: Jonathan Leitschuh <[email protected]> Signed-off-by: Jonathan Leitschuh <[email protected]> Bug-tracker: JLLeitschuh/security-research#18 Co-authored-by: Moderne <[email protected]>
BulkSecurityGeneratorProjectV2 · Nov 18, 2022 · 8594733 · 8594733
1 parent 0dfd50c
commit 8594733
Show file tree

Hide file tree

Showing 3 changed files with 9 additions and 6 deletions.
diff --git a/src/main/java/org/apache/maven/plugins/shade/mojo/ShadeMojo.java b/src/main/java/org/apache/maven/plugins/shade/mojo/ShadeMojo.java
@@ -65,6 +65,7 @@
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.io.Writer;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -1150,7 +1151,7 @@ private void rewriteDependencyReducedPomIfWeHaveReduction( List<Dependency> depe
                 if ( generateUniqueDependencyReducedPom )
                 {
                     dependencyReducedPomLocation =
-                        File.createTempFile( "dependency-reduced-pom-", ".xml", project.getBasedir() );
+                            Files.createTempFile( project.getBasedir().toPath(), "dependency-reduced-pom-", ".xml" ).toFile();
                     project.getProperties().setProperty( "maven.shade.dependency-reduced-pom",
                                                          dependencyReducedPomLocation.getAbsolutePath() );
                 }

diff --git a/src/test/java/org/apache/maven/plugins/shade/resource/GroovyResourceTransformerTest.java b/src/test/java/org/apache/maven/plugins/shade/resource/GroovyResourceTransformerTest.java
@@ -27,6 +27,7 @@
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.InputStream;
+import java.nio.file.Files;
 import java.util.Collections;
 import java.util.Properties;
 import java.util.jar.JarFile;
@@ -75,7 +76,7 @@ private static InputStream module( String name, String version, String extension
     private static Properties transform( GroovyResourceTransformer transformer )
         throws Exception
     {
-        File tempJar = File.createTempFile( "shade.", ".jar" );
+        File tempJar = Files.createTempFile( "shade.", ".jar" ).toFile();
         tempJar.deleteOnExit();
 
         try ( FileOutputStream fos = new FileOutputStream( tempJar );

diff --git a/src/test/java/org/apache/maven/plugins/shade/resource/ServiceResourceTransformerTest.java b/src/test/java/org/apache/maven/plugins/shade/resource/ServiceResourceTransformerTest.java
@@ -28,6 +28,7 @@
 import java.io.FileOutputStream;
 import java.io.InputStream;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.Collections;
@@ -65,7 +66,7 @@ public void relocatedClasses() throws Exception {
         xformer.processResource( contentResource, contentStream, relocators, 0 );
         contentStream.close();
 
-        File tempJar = File.createTempFile("shade.", ".jar");
+        File tempJar = Files.createTempFile( "shade.", ".jar" ).toFile();
         tempJar.deleteOnExit();
         FileOutputStream fos = new FileOutputStream( tempJar );
         try ( JarOutputStream jos = new JarOutputStream( fos ) ) {
@@ -109,7 +110,7 @@ public void mergeRelocatedFiles() throws Exception {
             xformer.processResource(contentResourceShaded, contentStream, relocators, 0);
         }
 
-        File tempJar = File.createTempFile("shade.", ".jar");
+        File tempJar = Files.createTempFile( "shade.", ".jar" ).toFile();
         tempJar.deleteOnExit();
         FileOutputStream fos = new FileOutputStream( tempJar );
         try ( JarOutputStream jos = new JarOutputStream( fos ) ) {
@@ -145,7 +146,7 @@ public void concatanationAppliedMultipleTimes() throws Exception {
         xformer.processResource( contentResource, contentStream, relocators, 0 );
         contentStream.close();
 
-        File tempJar = File.createTempFile("shade.", ".jar");
+        File tempJar = Files.createTempFile( "shade.", ".jar" ).toFile();
         tempJar.deleteOnExit();
         FileOutputStream fos = new FileOutputStream( tempJar );
         try ( JarOutputStream jos = new JarOutputStream( fos ) ) {
@@ -188,7 +189,7 @@ public void concatenation() throws Exception {
         xformer.processResource( contentResource, contentStream, relocators, 0 );
         contentStream.close();
 
-        File tempJar = File.createTempFile("shade.", ".jar");
+        File tempJar = Files.createTempFile( "shade.", ".jar" ).toFile();
         tempJar.deleteOnExit();
         FileOutputStream fos = new FileOutputStream( tempJar );
         try ( JarOutputStream jos = new JarOutputStream( fos ) ) {