Skip to content

Commit

Permalink
vuln-fix: Temporary Directory Hijacking or Information Disclosure (#152)
Browse files Browse the repository at this point in the history
This fixes either Temporary Directory Hijacking, or Temporary Directory Local Information Disclosure.

Weakness: CWE-379: Creation of Temporary File in Directory with Insecure Permissions
Severity: High
CVSSS: 7.3
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.UseFilesCreateTempDirectory)

Reported-by: Jonathan Leitschuh <[email protected]>


Bug-tracker: JLLeitschuh/security-research#10

Co-authored-by: Moderne <[email protected]>
  • Loading branch information
JLLeitschuh and TeamModerne authored Mar 21, 2023
1 parent f5856bd commit d179702
Show file tree
Hide file tree
Showing 3 changed files with 6 additions and 21 deletions.
Original file line number Diff line number Diff line change
Expand Up @@ -22,6 +22,7 @@
import java.io.IOException;
import java.io.StringWriter;
import java.nio.charset.Charset;
import java.nio.file.Files;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.NoSuchAlgorithmException;
Expand Down Expand Up @@ -64,13 +65,7 @@ public static String createTempJsonKeyFile(String clientEmail, PrivateKey privat

private static File getTempFolder() throws IOException {
if (tempFolder == null) {
tempFolder = File.createTempFile("temp", Long.toString(System.nanoTime()));
if (!tempFolder.delete()) {
throw new IOException("Could not delete temp file: " + tempFolder.getAbsolutePath());
}
if (!tempFolder.mkdir()) {
throw new IOException("Could not create temp directory: " + tempFolder.getAbsolutePath());
}
tempFolder = Files.createTempDirectory("temp" + Long.toString(System.nanoTime())).toFile();
tempFolder.deleteOnExit();
}
return tempFolder;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -21,6 +21,7 @@
import java.io.FileOutputStream;
import java.io.IOException;
import java.nio.charset.Charset;
import java.nio.file.Files;

/**
* Util class for {@link com.google.jenkins.plugins.credentials.oauth
Expand Down Expand Up @@ -86,13 +87,7 @@ public static String createTempInvalidLegacyJsonKeyFile() throws IOException {

private static File getTempFolder() throws IOException {
if (tempFolder == null) {
tempFolder = File.createTempFile("temp", Long.toString(System.nanoTime()));
if (!tempFolder.delete()) {
throw new IOException("Could not delete temp file: " + tempFolder.getAbsolutePath());
}
if (!tempFolder.mkdir()) {
throw new IOException("Could not create temp directory: " + tempFolder.getAbsolutePath());
}
tempFolder = Files.createTempDirectory("temp" + Long.toString(System.nanoTime())).toFile();
tempFolder.deleteOnExit();
}
return tempFolder;
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -19,6 +19,7 @@
import java.io.FileOutputStream;
import java.io.IOException;
import java.math.BigInteger;
import java.nio.file.Files;
import java.security.KeyPair;
import java.security.KeyPairGenerator;
import java.security.KeyStore;
Expand Down Expand Up @@ -64,13 +65,7 @@ public static String createTempP12KeyFile(KeyPair keyPair)

private static File getTempFolder() throws IOException {
if (tempFolder == null) {
tempFolder = File.createTempFile("temp", Long.toString(System.nanoTime()));
if (!tempFolder.delete()) {
throw new IOException("Could not delete temp file: " + tempFolder.getAbsolutePath());
}
if (!tempFolder.mkdir()) {
throw new IOException("Could not create temp directory: " + tempFolder.getAbsolutePath());
}
tempFolder = Files.createTempDirectory("temp" + Long.toString(System.nanoTime())).toFile();
tempFolder.deleteOnExit();
}
return tempFolder;
Expand Down

0 comments on commit d179702

Please sign in to comment.