vuln-fix: Temporary Directory Hijacking or Information Disclosure

This fixes either Temporary Directory Hijacking, or Temporary Directory Local Information Disclosure. Weakness: CWE-379: Creation of Temporary File in Directory with Insecure Permissions Severity: High CVSSS: 7.3 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.UseFilesCreateTempDirectory) Reported-by: Jonathan Leitschuh <[email protected]> Signed-off-by: Jonathan Leitschuh <[email protected]> Bug-tracker: JLLeitschuh/security-research#10 Co-authored-by: Moderne <[email protected]>
JLLeitschuh · Jul 27, 2022 · a65bf67 · a65bf67 · rvullriede · Oct 8, 2022
1 parent 4b726e3
commit a65bf67
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 6 deletions.
diff --git a/src/main/java/org/jenkinsci/backend/jpicreate/Application.java b/src/main/java/org/jenkinsci/backend/jpicreate/Application.java
@@ -21,6 +21,7 @@
 import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
@@ -67,10 +68,8 @@ public HttpResponse doGenerate(@QueryParameter("name") String _name, @QueryParam
         File settings = File.createTempFile("settings","xml");
         FileUtils.copyURLToFile(getClass().getClassLoader().getResource("settings.xml"),settings);
 
-        final File tmpDir = File.createTempFile("plugin","gen");
+        final File tmpDir = Files.createTempDirectory("plugin" + "gen").toFile();
         try {
-            tmpDir.delete();
-            tmpDir.mkdir();
 
             List<String> args = new ArrayList<String>();
             args.add(mvn.getAbsolutePath());

diff --git a/src/main/java/org/jenkinsci/backend/jpicreate/WebAppMain.java b/src/main/java/org/jenkinsci/backend/jpicreate/WebAppMain.java
@@ -10,6 +10,7 @@
 import javax.sound.midi.SysexMessage;
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 
 /**
  * @author Kohsuke Kawaguchi
@@ -41,9 +42,7 @@ private File extractMaven() throws IOException, InterruptedException {
         FileUtils.copyURLToFile(
                 getClass().getClassLoader().getResource("maven.zip"),
                 zip);
-        File bin = File.createTempFile("maven","bin");
-        bin.delete();
-        bin.mkdirs();
+        File bin = Files.createTempDirectory("maven" + "bin").toFile();
 
         Process unzip = new ProcessBuilder("unzip", zip.getAbsolutePath())
                 .directory(bin).redirectErrorStream(true).start();