This is an automated email from the ASF dual-hosted git repository.
cziegeler pushed a commit to branch master
in repository
https://gitbox.apache.org/repos/asf/sling-org-apache-sling-feature-analyser.git
The following commit(s) were added to refs/heads/master by this push:
new 4075901 vuln-fix: Temporary File Information Disclosure
new ca5435c Merge pull request #41 from
BulkSecurityGeneratorProjectV2/fix/JLL/temporary_file_local_information_disclosure
4075901 is described below
commit 40759017f927fa41edf6dbe98cf30d6d8687d16f
Author: Jonathan Leitschuh <[email protected]>
AuthorDate: Sat Nov 19 02:13:44 2022 +0000
vuln-fix: Temporary File Information Disclosure
This fixes temporary file information disclosure vulnerability due to the
use
of the vulnerable `File.createTempFile()` method. The vulnerability is
fixed by
using the `Files.createTempFile()` method which sets the correct posix
permissions.
Weakness: CWE-377: Insecure Temporary File
Severity: Medium
CVSSS: 5.5
Detection: CodeQL & OpenRewrite
(https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)
Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>
Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18
Co-authored-by: Moderne <[email protected]>
---
.../org/apache/sling/feature/scanner/impl/BundleDescriptorImplTest.java | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git
a/src/test/java/org/apache/sling/feature/scanner/impl/BundleDescriptorImplTest.java
b/src/test/java/org/apache/sling/feature/scanner/impl/BundleDescriptorImplTest.java
index b698942..69c4279 100644
---
a/src/test/java/org/apache/sling/feature/scanner/impl/BundleDescriptorImplTest.java
+++
b/src/test/java/org/apache/sling/feature/scanner/impl/BundleDescriptorImplTest.java
@@ -110,7 +110,7 @@ public class BundleDescriptorImplTest
private File createBundle(String manifest) throws IOException
{
- File f = File.createTempFile("bundle", ".jar");
+ File f = Files.createTempFile("bundle", ".jar").toFile();
f.deleteOnExit();
Manifest mf = new Manifest(new
ByteArrayInputStream(manifest.getBytes("UTF-8")));
mf.getMainAttributes().putValue("Manifest-Version", "1.0");
