This is an automated email from the ASF dual-hosted git repository.
dklco pushed a commit to branch master
in repository
https://gitbox.apache.org/repos/asf/sling-org-apache-sling-settings.git
The following commit(s) were added to refs/heads/master by this push:
new 1b0149f vuln-fix: Temporary File Information Disclosure
new 5f9622a Merge pull request #4 from
BulkSecurityGeneratorProjectV2/fix/JLL/temporary_file_local_information_disclosure
1b0149f is described below
commit 1b0149fe42c2b0dda203ac2db38b2e171af3c4d2
Author: Jonathan Leitschuh <[email protected]>
AuthorDate: Fri Nov 18 22:46:37 2022 +0000
vuln-fix: Temporary File Information Disclosure
This fixes temporary file information disclosure vulnerability due to the
use
of the vulnerable `File.createTempFile()` method. The vulnerability is
fixed by
using the `Files.createTempFile()` method which sets the correct posix
permissions.
Weakness: CWE-377: Insecure Temporary File
Severity: Medium
CVSSS: 5.5
Detection: CodeQL & OpenRewrite
(https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)
Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>
Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18
Co-authored-by: Moderne <[email protected]>
---
.../org/apache/sling/settings/impl/SlingSettingsServiceImplTest.java | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git
a/src/test/java/org/apache/sling/settings/impl/SlingSettingsServiceImplTest.java
b/src/test/java/org/apache/sling/settings/impl/SlingSettingsServiceImplTest.java
index e47bc46..cb6b063 100644
---
a/src/test/java/org/apache/sling/settings/impl/SlingSettingsServiceImplTest.java
+++
b/src/test/java/org/apache/sling/settings/impl/SlingSettingsServiceImplTest.java
@@ -27,6 +27,7 @@ import java.io.File;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.ObjectOutputStream;
+import java.nio.file.Files;
import java.util.ArrayList;
import java.util.Collections;
import java.util.HashMap;
@@ -58,8 +59,8 @@ public class SlingSettingsServiceImplTest {
@Before
public void before() throws IOException {
- slingIdFile = File.createTempFile(SLING_ID_FILE_NAME, "");
- optionsFile = File.createTempFile(OPTIONS_FILE_NAME, "");
+ slingIdFile = Files.createTempFile(SLING_ID_FILE_NAME, "").toFile();
+ optionsFile = Files.createTempFile(OPTIONS_FILE_NAME, "").toFile();
Converter c = Converters.standardConverter();
// use standard configuration
configuration = c.convert(new HashMap<String,
Object>()).to(SlingSettingsServiceImpl.Configuration.class);
