naruto-lgtm opened a new pull request, #1500: URL: https://github.com/apache/poi/pull/1500
Repro: as user A, `mkdir -m 777 /tmp/poifiles`. User B's `SXSSFWorkbook` keeps its sheet XML in that directory; A deletes and recreates `poi-sxssf-sheet*.xml` before `write()`, and B's .xlsx contains A's rows. The same applies to the temp file `ZipPackage` copies over the target on close, and a symlink planted between `createTempFile` and the reopen makes B overwrite one of B's own files. Cause: `createPOIFilesDirectoryIfNecessary` accepts any existing `<java.io.tmpdir>/poifiles` (or `poifiles_<user>` for `UserNameAwareTempFileCreationStrategy`) as long as it is a directory, and ignores a failed chmod when it creates one. The 0600 files from #1063 don't help: whoever owns the directory can delete and replace entries, and POI reopens its temp files by path (insecure temporary directory, CWE-379). Fix: resolve the default directory to its real path and, on POSIX file systems, only use it if it has the same owner as a probe file created in it (no `user.name` lookup), otherwise fail with an IOException that says what to do. Directories passed to the constructor are not checked. The only setup that now fails is a default directory owned by someone else that the current user can still write to, e.g. a shared 1777 `poifiles`. Since #1063 a directory created by another POI process is 0700 and already unusable for other users. Non-POSIX file systems (Windows) skip the check. `testDirectoryOwnedByOtherUser` uses the root-owned `/tmp` as the foreign directory and fails before the change. Locally `:poi:check` passes apart from `TestDateSerialRange.testEdgesOfTheRange`, which fails the same way on trunk here. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected] --------------------------------------------------------------------- To unsubscribe, e-mail: [email protected] For additional commands, e-mail: [email protected]
