vuln-fix: Temporary File Information Disclosure (#60)

This fixes temporary file information disclosure vulnerability due to the use
of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by
using the `Files.createTempFile()` method which sets the correct posix permissions.

Weakness: CWE-377: Insecure Temporary File
Severity: Medium
CVSSS: 5.5
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)

Reported-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#18

Co-authored-by: Moderne <[email protected]>

src/main/java/org/jvnet/hudson/plugins/repositoryconnector/util/FilePathUtils.java

@@ -26,7 +26,7 @@ static OutputStream createOutputStream(File file) throws IOException {
     }
 
     static File createTempFile(String prefix, String suffix) throws IOException {
-        File file = File.createTempFile(prefix + "-", "." + suffix);
+        File file = Files.createTempFile(prefix + "-", "." + suffix).toFile();
         // always delete on exit but try to delete sooner...
         file.deleteOnExit();