[juneau] branch master updated: vuln-fix: Temporary File Information Disclosure

[jamesbognar]

This is an automated email from the ASF dual-hosted git repository.

jamesbognar pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/juneau.git


The following commit(s) were added to refs/heads/master by this push:
     new 0b191189c vuln-fix: Temporary File Information Disclosure
     new 963188972 Merge pull request #75 from 
BulkSecurityGeneratorProjectV2/fix/JLL/temporary_file_local_information_disclosure
0b191189c is described below

commit 0b191189c87a4e869dfda51df5ba8e75697eee2c
Author: Jonathan Leitschuh <jonathan.leitsc...@gmail.com>
AuthorDate: Fri Nov 18 22:46:35 2022 +0000

    vuln-fix: Temporary File Information Disclosure
    
    
    
    This fixes temporary file information disclosure vulnerability due to the 
use
    of the vulnerable `File.createTempFile()` method. The vulnerability is 
fixed by
    using the `Files.createTempFile()` method which sets the correct posix 
permissions.
    
    Weakness: CWE-377: Insecure Temporary File
    Severity: Medium
    CVSSS: 5.5
    Detection: CodeQL & OpenRewrite 
(https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)
    
    Reported-by: Jonathan Leitschuh <jonathan.leitsc...@gmail.com>
    Signed-off-by: Jonathan Leitschuh <jonathan.leitsc...@gmail.com>
    
    Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18
    
    
    Co-authored-by: Moderne <t...@moderne.io>
---
 .../src/test/java/org/apache/juneau/http/BasicHttpResource_Test.java   | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git 
a/juneau-utest/src/test/java/org/apache/juneau/http/BasicHttpResource_Test.java 
b/juneau-utest/src/test/java/org/apache/juneau/http/BasicHttpResource_Test.java
index c84e5e1ff..85fe77b90 100644
--- 
a/juneau-utest/src/test/java/org/apache/juneau/http/BasicHttpResource_Test.java
+++ 
b/juneau-utest/src/test/java/org/apache/juneau/http/BasicHttpResource_Test.java
@@ -20,6 +20,7 @@ import static org.junit.runners.MethodSorters.*;
 import static org.apache.juneau.testutils.StreamUtils.*;
 
 import java.io.*;
+import java.nio.file.Files;
 
 import org.apache.juneau.http.resource.*;
 import org.apache.juneau.http.header.*;
@@ -29,7 +30,7 @@ import org.junit.*;
 public class BasicHttpResource_Test {
        @Test
        public void a01_basic() throws Exception {
-               File f = File.createTempFile("test", "txt");
+               File f = Files.createTempFile("test","txt").toFile();
 
                HttpResource x = stringResource((String)null);