vuln-fix: Temporary File Information Disclosure

This fixes temporary file information disclosure vulnerability due to the use of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by using the `Files.createTempFile()` method which sets the correct posix permissions. Weakness: CWE-377: Insecure Temporary File Severity: Medium CVSSS: 5.5 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation) Reported-by: Jonathan Leitschuh <[email protected]> Signed-off-by: Jonathan Leitschuh <[email protected]> Bug-tracker: JLLeitschuh/security-research#18 Co-authored-by: Moderne <[email protected]>
jd-opensource · Nov 19, 2022 · 9509ffe · 9509ffe
1 parent a88914c
commit 9509ffe
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/joyqueue-common/joyqueue-toolkit/src/test/java/org/joyqueue/toolkit/os/SystemsTest.java b/joyqueue-common/joyqueue-toolkit/src/test/java/org/joyqueue/toolkit/os/SystemsTest.java
@@ -22,6 +22,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 
 /**
  * Created by hexiaofeng on 16-7-4.
@@ -32,7 +33,7 @@ public class SystemsTest {
     public void testGetCores() throws IOException {
         System.out.println(Systems.getCores());
         Systems.JDOS1CoresDetector.ETC_CONFIG_INFO = "";
-        File file = File.createTempFile("config_info", "");
+        File file = Files.createTempFile("config_info", "").toFile();
         Files.write(file,
                 "{\"Config\": {\"Cpuset\": \"1,2\", \"Memory\": 4294967296}, \"host_ip\": \"10.8.65" + ".251\"}");
         String config = Systems.JDOS1CoresDetector.ETC_CONFIG_INFO;