vuln-fix: Temporary File Information Disclosure

This fixes temporary file information disclosure vulnerability due to the use of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by using the `Files.createTempFile()` method which sets the correct posix permissions. Weakness: CWE-377: Insecure Temporary File Severity: Medium CVSSS: 5.5 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation) Reported-by: Jonathan Leitschuh <[email protected]> Signed-off-by: Jonathan Leitschuh <[email protected]> Bug-tracker: JLLeitschuh/security-research#18 Co-authored-by: Moderne <[email protected]>
BulkSecurityGeneratorProjectV2 · Nov 18, 2022 · 9f6b639 · 9f6b639
1 parent f3dda25
commit 9f6b639
Show file tree

Hide file tree

Showing 18 changed files with 38 additions and 22 deletions.
diff --git a/...st/java/org/apache/oodt/cas/cli/option/validator/TestFileExistCmdLineOptionValidator.java b/...st/java/org/apache/oodt/cas/cli/option/validator/TestFileExistCmdLineOptionValidator.java
@@ -23,8 +23,8 @@
 //JDK imports
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 
-//JUnit imports
 import junit.framework.TestCase;
 
 //OODT imports
@@ -54,7 +54,7 @@ public void testValidate() throws IOException {
             .validate(instance).getGrade());
 
       // Test pass case.
-      File tempFile = File.createTempFile("bogus", "bogus");
+      File tempFile = Files.createTempFile("bogus", "bogus").toFile();
       tempFile.deleteOnExit();
       instance = createOptionInstance(createSimpleOption("test", false),
             tempFile.getAbsolutePath());

diff --git a/commons/src/test/java/org/apache/oodt/commons/ConfigurationTest.java b/commons/src/test/java/org/apache/oodt/commons/ConfigurationTest.java
@@ -16,6 +16,7 @@
 package org.apache.oodt.commons;
 
 import java.io.*;
+import java.nio.file.Files;
 import java.util.*;
 import junit.framework.*;
 
@@ -33,7 +34,7 @@ public ConfigurationTest(String name) {
 
 	protected void setUp() throws Exception {
 		// Create a temporary test configuration file.
-		tmpFile = File.createTempFile("conf", ".xml");
+		tmpFile = Files.createTempFile("conf", ".xml").toFile();
 		BufferedOutputStream out = new BufferedOutputStream(new FileOutputStream(tmpFile));
 		byte[] doc = TEST_DOC.getBytes();
 		out.write(doc, 0, doc.length);

diff --git a/commons/src/test/java/org/apache/oodt/commons/object/jndi/ObjectContextTest.java b/commons/src/test/java/org/apache/oodt/commons/object/jndi/ObjectContextTest.java
@@ -17,6 +17,7 @@
 
 import java.io.File;
 import java.io.FileOutputStream;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Properties;
@@ -46,7 +47,7 @@ public ObjectContextTest(String caseName) {
 	public void setUp() throws Exception {
 		super.setUp();
 
-		aliasFile = File.createTempFile("test", ".properties");
+		aliasFile = Files.createTempFile("test", ".properties").toFile();
 		aliasFile.deleteOnExit();
 		Properties aliases = new Properties();
 		aliases.setProperty("urn:alias:x", "urn:a:x");

diff --git a/.../src/test/java/org/apache/oodt/cas/crawl/typedetection/TestMimeExtractorConfigReader.java b/.../src/test/java/org/apache/oodt/cas/crawl/typedetection/TestMimeExtractorConfigReader.java
@@ -18,6 +18,7 @@
 
 //JDK imports
 import java.io.File;
+import java.nio.file.Files;
 import java.util.List;
 import java.util.UUID;
 
@@ -47,7 +48,7 @@ public class TestMimeExtractorConfigReader extends TestCase {
 
    @Override
    public void setUp() throws Exception {
-      File tmpFile = File.createTempFile("bogus", "bogus");
+      File tmpFile = Files.createTempFile("bogus", "bogus").toFile();
       tmpDir = new File(tmpFile.getParentFile(), UUID.randomUUID().toString());
       tmpFile.delete();
       if (!tmpDir.mkdirs()) {

diff --git a/filemgr/src/test/java/org/apache/oodt/cas/filemgr/catalog/TestDataSourceCatalog.java b/filemgr/src/test/java/org/apache/oodt/cas/filemgr/catalog/TestDataSourceCatalog.java
@@ -35,6 +35,7 @@
 import java.io.File;
 import java.io.FileInputStream;
 import java.net.URL;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.Properties;
@@ -99,7 +100,7 @@ public void setUpProperties() {
             File tempFile;
 
             try {
-                tempFile = File.createTempFile("foo", "bar");
+                tempFile = Files.createTempFile("foo", "bar").toFile();
                 tempFile.deleteOnExit();
                 tempDir = tempFile.getParentFile();
             } catch (Exception e) {

diff --git a/filemgr/src/test/java/org/apache/oodt/cas/filemgr/catalog/TestLuceneCatalog.java b/filemgr/src/test/java/org/apache/oodt/cas/filemgr/catalog/TestLuceneCatalog.java
@@ -37,6 +37,7 @@
 import java.io.File;
 import java.io.FileInputStream;
 import java.net.URL;
+import java.nio.file.Files;
 import java.util.List;
 import java.util.Properties;
 import java.util.Vector;
@@ -93,7 +94,7 @@ public void setUpProperties() {
         File tempFile;
 
         try {
-            tempFile = File.createTempFile("foo", "bar");
+            tempFile = Files.createTempFile("foo", "bar").toFile();
             tempFile.deleteOnExit();
             tempDir = tempFile.getParentFile();
         } catch (Exception e) {

diff --git a/filemgr/src/test/java/org/apache/oodt/cas/filemgr/cli/TestFileManagerCli.java b/filemgr/src/test/java/org/apache/oodt/cas/filemgr/cli/TestFileManagerCli.java
@@ -21,6 +21,7 @@
 import java.io.IOException;
 import java.net.MalformedURLException;
 import java.net.URL;
+import java.nio.file.Files;
 import java.util.Properties;
 //JUnit imports
 import junit.framework.TestCase;
@@ -323,7 +324,7 @@ public void testIngestProduct() {
 
    public void testDumpMetadata() throws IOException {
       String productId = "TestProductId";
-      File bogusFile = File.createTempFile("bogus", "bogus");
+      File bogusFile = Files.createTempFile("bogus", "bogus").toFile();
       File tmpFile = new File(bogusFile.getParentFile(), "CliDumpMetadata");
       tmpFile.mkdirs();
       bogusFile.delete();

diff --git a/filemgr/src/test/java/org/apache/oodt/cas/filemgr/cli/action/TestDumpMetadataCliAction.java b/filemgr/src/test/java/org/apache/oodt/cas/filemgr/cli/action/TestDumpMetadataCliAction.java
@@ -24,8 +24,8 @@
 import java.io.IOException;
 import java.net.MalformedURLException;
 import java.net.URL;
+import java.nio.file.Files;
 
-//Apache imports
 import org.apache.commons.io.FileUtils;
 
 //OODT imports
@@ -53,7 +53,7 @@ public class TestDumpMetadataCliAction extends TestCase {
 
    @Override
    public void setUp() throws Exception {
-      File bogusFile = File.createTempFile("bogus", "bogus");
+      File bogusFile = Files.createTempFile("bogus", "bogus").toFile();
       tmpFile = new File(bogusFile.getParentFile(), "MetadataDump");
       tmpFile.mkdirs();
       bogusFile.delete();

diff --git a/filemgr/src/test/java/org/apache/oodt/cas/filemgr/cli/action/TestIngestProductCliAction.java b/filemgr/src/test/java/org/apache/oodt/cas/filemgr/cli/action/TestIngestProductCliAction.java
@@ -23,6 +23,7 @@
 import java.io.PrintStream;
 import java.net.MalformedURLException;
 import java.net.URL;
+import java.nio.file.Files;
 import java.util.Collections;
 import java.util.Comparator;
 
@@ -237,7 +238,7 @@ public int compare(Reference ref1, Reference ref2) {
    }
 
    private File createTmpDir() throws IOException {
-      File bogusDir = File.createTempFile("bogus", "bogus");
+      File bogusDir = Files.createTempFile("bogus", "bogus").toFile();
       File tmpDir = bogusDir.getParentFile();
       bogusDir.delete();
       tmpDir = new File(tmpDir, "Metadata");

diff --git a/...mgr/src/test/java/org/apache/oodt/cas/filemgr/datatransfer/TestInPlaceDataTransferer.java b/...mgr/src/test/java/org/apache/oodt/cas/filemgr/datatransfer/TestInPlaceDataTransferer.java
@@ -24,8 +24,8 @@
 
 //JDK imports
 import java.io.File;
+import java.nio.file.Files;
 
-//Junit imports
 import junit.framework.TestCase;
 
 /**
@@ -48,7 +48,7 @@ public TestInPlaceDataTransferer() {
         transfer = (InPlaceDataTransferer) new InPlaceDataTransferFactory()
                 .createDataTransfer();
         try {
-            File tempFileSrc = File.createTempFile("foo", ".txt");
+            File tempFileSrc = Files.createTempFile("foo", ".txt").toFile();
             tempFileSrc.deleteOnExit();
             productOrigLoc = tempFileSrc.getAbsolutePath();
             productExpectedLoc = tempFileSrc.getParent();

diff --git a/filemgr/src/test/java/org/apache/oodt/cas/filemgr/datatransfer/TestLocalDataTransferer.java b/filemgr/src/test/java/org/apache/oodt/cas/filemgr/datatransfer/TestLocalDataTransferer.java
@@ -28,6 +28,7 @@
 import java.io.File;
 import java.io.IOException;
 import java.net.URL;
+import java.nio.file.Files;
 import java.util.UUID;
 
 //Junit imports
@@ -55,7 +56,7 @@ public void setUp() throws Exception {
          .createDataTransfer();
       URL url = this.getClass().getResource("/test.txt");
       origFile = new File(url.getFile());
-      File testFile = File.createTempFile("test", ".txt");
+      File testFile = Files.createTempFile("test", ".txt").toFile();
       testDir = new File(testFile.getParentFile(), UUID.randomUUID().toString());
       repoDir = new File(testDir, "repo");
       if (!repoDir.mkdirs()) {

diff --git a/filemgr/src/test/java/org/apache/oodt/cas/filemgr/structs/type/TestTypeHandler.java b/filemgr/src/test/java/org/apache/oodt/cas/filemgr/structs/type/TestTypeHandler.java
@@ -44,6 +44,7 @@
 import java.io.FileInputStream;
 import java.net.MalformedURLException;
 import java.net.URL;
+import java.nio.file.Files;
 import java.sql.Connection;
 import java.sql.ResultSet;
 import java.sql.SQLException;
@@ -99,7 +100,7 @@ public void setUpProperties() {
         File tempFile;
 
         try {
-            tempFile = File.createTempFile("foo", "bar");
+            tempFile = Files.createTempFile("foo", "bar").toFile();
             tempFile.deleteOnExit();
             tempDir = tempFile.getParentFile();
         } catch (Exception e) {

diff --git a/.../src/test/java/org/apache/oodt/cas/metadata/filenaming/TestPathUtilsNamingConvention.java b/.../src/test/java/org/apache/oodt/cas/metadata/filenaming/TestPathUtilsNamingConvention.java
@@ -19,6 +19,7 @@
 //JDK imports
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.UUID;
 
 //Apache imports
@@ -39,7 +40,7 @@
 public class TestPathUtilsNamingConvention extends TestCase {
 
    public void testRename() throws IOException, NamingConventionException {
-      File tmpFile = File.createTempFile("bogus", "bogus");
+      File tmpFile = Files.createTempFile("bogus", "bogus").toFile();
       File tmpDir = new File(tmpFile.getParentFile(),
             UUID.randomUUID().toString());
       if (!tmpDir.mkdirs()) {

diff --git a/pge/src/test/java/org/apache/oodt/cas/pge/TestPGETaskInstance.java b/pge/src/test/java/org/apache/oodt/cas/pge/TestPGETaskInstance.java
@@ -55,6 +55,7 @@
 import java.io.FileInputStream;
 import java.io.StringReader;
 import java.net.URL;
+import java.nio.file.Files;
 import java.util.Collections;
 import java.util.List;
 import java.util.Map;
@@ -77,6 +78,7 @@
 import static org.junit.Assert.assertTrue;
 import static org.junit.Assert.fail;
 import static org.junit.Assume.assumeTrue;
+
 //JDK imports
 //JUnit imports
 //Apache imports
@@ -647,7 +649,7 @@ private PGETaskInstance createTestInstance(String workflowInstId)
    }
 
    private File createTmpDir() throws Exception {
-      File tmpFile = File.createTempFile("bogus", "bogus");
+      File tmpFile = Files.createTempFile("bogus", "bogus").toFile();
       File tmpDir = new File(tmpFile.getParentFile(), UUID.randomUUID().toString());
       tmpFile.delete();
       tmpDir.mkdirs();

diff --git a/pge/src/test/java/org/apache/oodt/cas/pge/writers/VelocityConfigFileWriterTest.java b/pge/src/test/java/org/apache/oodt/cas/pge/writers/VelocityConfigFileWriterTest.java
@@ -23,6 +23,7 @@
 import java.io.File;
 import java.io.IOException;
 import java.net.URL;
+import java.nio.file.Files;
 import java.util.logging.Level;
 import java.util.logging.Logger;
 
@@ -40,7 +41,7 @@ public void testCreateConfigFile() throws IOException {
     metadata.addMetadata("name", "Chris");
     metadata.addMetadata("name", "Paul");
     metadata.addMetadata("conference", "ApacheCon");
-    File config = File.createTempFile("config", ".out");
+    File config = Files.createTempFile("config", ".out").toFile();
     try {
       vcfw.generateFile(config.toString(), metadata, LOG, url.getFile());
     } catch (Exception e) {

diff --git a/...ices/src/main/java/org/apache/oodt/cas/wmservices/repository/PackagedWorkflowManager.java b/...ices/src/main/java/org/apache/oodt/cas/wmservices/repository/PackagedWorkflowManager.java
@@ -19,6 +19,7 @@
 
 import java.io.File;
 import java.io.FileOutputStream;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Collections;
 import java.util.List;
@@ -83,7 +84,7 @@ public String serializeWorkflow(Workflow workflow) throws RepositoryException {
     try {
       this.loadTasksToRepo(workflow);
       String workflowId = this.repo.addWorkflow(workflow);
-      File f = File.createTempFile("tempworkflow-", "-packaged");
+      File f = Files.createTempFile("tempworkflow-", "-packaged").toFile();
       this.saveWorkflow(workflowId, f.getAbsolutePath());
       String workflowXML = FileUtils.readFileToString(f);
       f.delete();
@@ -107,7 +108,7 @@ public String serializeWorkflow(Workflow workflow) throws RepositoryException {
   public Workflow parsePackagedWorkflow(String workflowID, String workflowXML)
       throws RepositoryException {
     try {
-      File tmpfile = File.createTempFile("tempworkflow-", "-packaged");
+      File tmpfile = Files.createTempFile("tempworkflow-", "-packaged").toFile();
       FileUtils.writeStringToFile(tmpfile, workflowXML);
       PackagedWorkflowRepository tmprepo = new PackagedWorkflowRepository(
           Collections.singletonList(tmpfile));

diff --git a/...test/java/org/apache/oodt/cas/workflow/instrepo/TestLuceneWorkflowInstanceRepository.java b/...test/java/org/apache/oodt/cas/workflow/instrepo/TestLuceneWorkflowInstanceRepository.java
@@ -31,6 +31,7 @@
 //JDK imports
 import java.io.File;
 import java.io.FileInputStream;
+import java.nio.file.Files;
 import java.util.List;
 import java.util.Vector;
 
@@ -114,7 +115,7 @@ public TestLuceneWorkflowInstanceRepository() {
         File tempFile;
 
         try {
-            tempFile = File.createTempFile("foo", "bar");
+            tempFile = Files.createTempFile("foo", "bar").toFile();
             tempFile.deleteOnExit();
             tempDir = tempFile.getParentFile();
         } catch (Exception e) {

diff --git a/...c/test/java/org/apache/oodt/cas/workflow/repository/TestWorkflowDataSourceRepository.java b/...c/test/java/org/apache/oodt/cas/workflow/repository/TestWorkflowDataSourceRepository.java
@@ -37,6 +37,7 @@
 import java.io.File;
 import java.io.FileInputStream;
 import java.io.FileNotFoundException;
+import java.nio.file.Files;
 import java.sql.SQLException;
 import java.util.ArrayList;
 import java.util.Collections;
@@ -82,7 +83,7 @@ public TestWorkflowDataSourceRepository() throws SQLException, FileNotFoundExcep
         File tempFile;
 
         try {
-            tempFile = File.createTempFile("foo", "bar");
+            tempFile = Files.createTempFile("foo", "bar").toFile();
             tempFile.deleteOnExit();
             tempDir = tempFile.getParentFile();
         } catch (Exception e) {