vuln-fix: Temporary Directory Hijacking or Information Disclosure

This fixes either Temporary Directory Hijacking, or Temporary Directory Local Information Disclosure. Weakness: CWE-379: Creation of Temporary File in Directory with Insecure Permissions Severity: High CVSSS: 7.3 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.UseFilesCreateTempDirectory) Reported-by: Jonathan Leitschuh <[email protected]> Signed-off-by: Jonathan Leitschuh <[email protected]> Bug-tracker: JLLeitschuh/security-research#10 Co-authored-by: Moderne <[email protected]>
JLLeitschuh · Jul 27, 2022 · 1e76b2b · 1e76b2b
1 parent 3e03b2c
commit 1e76b2b
Show file tree

Hide file tree

Showing 3 changed files with 6 additions and 21 deletions.
diff --git a/...t/java/com/google/jenkins/plugins/credentials/oauth/JsonServiceAccountConfigTestUtil.java b/...t/java/com/google/jenkins/plugins/credentials/oauth/JsonServiceAccountConfigTestUtil.java
@@ -22,6 +22,7 @@
 import java.io.IOException;
 import java.io.StringWriter;
 import java.nio.charset.Charset;
+import java.nio.file.Files;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.NoSuchAlgorithmException;
@@ -64,13 +65,7 @@ public static String createTempJsonKeyFile(String clientEmail, PrivateKey privat
 
   private static File getTempFolder() throws IOException {
     if (tempFolder == null) {
-      tempFolder = File.createTempFile("temp", Long.toString(System.nanoTime()));
-      if (!tempFolder.delete()) {
-        throw new IOException("Could not delete temp file: " + tempFolder.getAbsolutePath());
-      }
-      if (!tempFolder.mkdir()) {
-        throw new IOException("Could not create temp directory: " + tempFolder.getAbsolutePath());
-      }
+      tempFolder = Files.createTempDirectory("temp" + Long.toString(System.nanoTime())).toFile();
       tempFolder.deleteOnExit();
     }
     return tempFolder;

diff --git a/...java/com/google/jenkins/plugins/credentials/oauth/LegacyJsonServiceAccountConfigUtil.java b/...java/com/google/jenkins/plugins/credentials/oauth/LegacyJsonServiceAccountConfigUtil.java
@@ -21,6 +21,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.nio.charset.Charset;
+import java.nio.file.Files;
 
 /**
  * Util class for {@link com.google.jenkins.plugins.credentials.oauth
@@ -86,13 +87,7 @@ public static String createTempInvalidLegacyJsonKeyFile() throws IOException {
 
   private static File getTempFolder() throws IOException {
     if (tempFolder == null) {
-      tempFolder = File.createTempFile("temp", Long.toString(System.nanoTime()));
-      if (!tempFolder.delete()) {
-        throw new IOException("Could not delete temp file: " + tempFolder.getAbsolutePath());
-      }
-      if (!tempFolder.mkdir()) {
-        throw new IOException("Could not create temp directory: " + tempFolder.getAbsolutePath());
-      }
+      tempFolder = Files.createTempDirectory("temp" + Long.toString(System.nanoTime())).toFile();
       tempFolder.deleteOnExit();
     }
     return tempFolder;

diff --git a/...st/java/com/google/jenkins/plugins/credentials/oauth/P12ServiceAccountConfigTestUtil.java b/...st/java/com/google/jenkins/plugins/credentials/oauth/P12ServiceAccountConfigTestUtil.java
@@ -19,6 +19,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.math.BigInteger;
+import java.nio.file.Files;
 import java.security.KeyPair;
 import java.security.KeyPairGenerator;
 import java.security.KeyStore;
@@ -64,13 +65,7 @@ public static String createTempP12KeyFile(KeyPair keyPair)
 
   private static File getTempFolder() throws IOException {
     if (tempFolder == null) {
-      tempFolder = File.createTempFile("temp", Long.toString(System.nanoTime()));
-      if (!tempFolder.delete()) {
-        throw new IOException("Could not delete temp file: " + tempFolder.getAbsolutePath());
-      }
-      if (!tempFolder.mkdir()) {
-        throw new IOException("Could not create temp directory: " + tempFolder.getAbsolutePath());
-      }
+      tempFolder = Files.createTempDirectory("temp" + Long.toString(System.nanoTime())).toFile();
       tempFolder.deleteOnExit();
     }
     return tempFolder;