This is an automated email from the ASF dual-hosted git repository.
enorman pushed a commit to branch master
in repository
https://gitbox.apache.org/repos/asf/sling-org-apache-sling-launchpad-integration-tests.git
The following commit(s) were added to refs/heads/master by this push:
new 55a9e70 vuln-fix: Temporary File Information Disclosure
new a135ab1 Merge pull request #10 from
BulkSecurityGeneratorProjectV2/fix/JLL/temporary_file_local_information_disclosure
55a9e70 is described below
commit 55a9e70bc1f2df03b022c2a5e265927d45c19f52
Author: Jonathan Leitschuh <[email protected]>
AuthorDate: Fri Nov 18 22:46:46 2022 +0000
vuln-fix: Temporary File Information Disclosure
This fixes temporary file information disclosure vulnerability due to the
use
of the vulnerable `File.createTempFile()` method. The vulnerability is
fixed by
using the `Files.createTempFile()` method which sets the correct posix
permissions.
Weakness: CWE-377: Insecure Temporary File
Severity: Medium
CVSSS: 5.5
Detection: CodeQL & OpenRewrite
(https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)
Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>
Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18
Co-authored-by: Moderne <[email protected]>
---
.../webapp/integrationtest/servlets/post/PostServletImportTest.java | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git
a/src/main/java/org/apache/sling/launchpad/webapp/integrationtest/servlets/post/PostServletImportTest.java
b/src/main/java/org/apache/sling/launchpad/webapp/integrationtest/servlets/post/PostServletImportTest.java
index cbe86e4..4ad3cfe 100644
---
a/src/main/java/org/apache/sling/launchpad/webapp/integrationtest/servlets/post/PostServletImportTest.java
+++
b/src/main/java/org/apache/sling/launchpad/webapp/integrationtest/servlets/post/PostServletImportTest.java
@@ -21,6 +21,7 @@ import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.InputStreamReader;
+import java.nio.file.Files;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.HashSet;
@@ -84,7 +85,7 @@ public class PostServletImportTest extends HttpTestBase {
}
private File getTestFile(InputStream inputStream) throws IOException {
- File tempFile = File.createTempFile("file-to-upload", null, new
File("target"));
+ File tempFile = Files.createTempFile(new File("target").toPath(),
"file-to-upload", null).toFile();
FileOutputStream outputStream = new FileOutputStream(tempFile);
byte[] bbuf = new byte[16384]; //16k
int len;
