You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@maven.apache.org by hb...@apache.org on 2023/01/22 09:13:00 UTC
[maven-assembly-plugin] branch master updated: vuln-fix: Temporary File Information Disclosure
This is an automated email from the ASF dual-hosted git repository.
hboutemy pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/maven-assembly-plugin.git
The following commit(s) were added to refs/heads/master by this push:
new f5ccd4d5 vuln-fix: Temporary File Information Disclosure
f5ccd4d5 is described below
commit f5ccd4d5cc0de1f8a6be0347f53075b0d337f0e7
Author: Jonathan Leitschuh <Jo...@gmail.com>
AuthorDate: Fri Nov 18 22:42:41 2022 +0000
vuln-fix: Temporary File Information Disclosure
This fixes temporary file information disclosure vulnerability due to the use
of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by
using the `Files.createTempFile()` method which sets the correct posix permissions.
Weakness: CWE-377: Insecure Temporary File
Severity: Medium
CVSSS: 5.5
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)
Reported-by: Jonathan Leitschuh <Jo...@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jo...@gmail.com>
Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18
Co-authored-by: Moderne <te...@moderne.io>
---
.../plugins/assembly/filter/AbstractLineAggregatingHandler.java | 3 ++-
.../plugins/assembly/filter/ComponentsXmlArchiverFileFilter.java | 2 +-
.../plugins/assembly/filter/SimpleAggregatingDescriptorHandler.java | 3 ++-
src/main/java/org/apache/maven/plugins/assembly/io/URLLocation.java | 3 ++-
.../apache/maven/plugins/assembly/io/DefaultAssemblyReaderTest.java | 2 +-
.../apache/maven/plugins/assembly/utils/LineEndingsUtilsTest.java | 5 +++--
6 files changed, 11 insertions(+), 7 deletions(-)
diff --git a/src/main/java/org/apache/maven/plugins/assembly/filter/AbstractLineAggregatingHandler.java b/src/main/java/org/apache/maven/plugins/assembly/filter/AbstractLineAggregatingHandler.java
index 57b6b5c7..572880ca 100644
--- a/src/main/java/org/apache/maven/plugins/assembly/filter/AbstractLineAggregatingHandler.java
+++ b/src/main/java/org/apache/maven/plugins/assembly/filter/AbstractLineAggregatingHandler.java
@@ -33,6 +33,7 @@ import java.io.IOException;
import java.io.InputStreamReader;
import java.io.OutputStreamWriter;
import java.io.PrintWriter;
+import java.nio.file.Files;
import java.util.ArrayList;
import java.util.HashMap;
import java.util.List;
@@ -81,7 +82,7 @@ abstract class AbstractLineAggregatingHandler
File f;
try
{
- f = File.createTempFile( "assembly-" + fname, ".tmp" );
+ f = Files.createTempFile( "assembly-" + fname, ".tmp" ).toFile();
f.deleteOnExit();
try ( PrintWriter writer =
diff --git a/src/main/java/org/apache/maven/plugins/assembly/filter/ComponentsXmlArchiverFileFilter.java b/src/main/java/org/apache/maven/plugins/assembly/filter/ComponentsXmlArchiverFileFilter.java
index 83936fce..d64f3ca5 100644
--- a/src/main/java/org/apache/maven/plugins/assembly/filter/ComponentsXmlArchiverFileFilter.java
+++ b/src/main/java/org/apache/maven/plugins/assembly/filter/ComponentsXmlArchiverFileFilter.java
@@ -102,7 +102,7 @@ public class ComponentsXmlArchiverFileFilter
{
if ( components != null )
{
- final File f = File.createTempFile( "maven-assembly-plugin", "tmp" );
+ final File f = Files.createTempFile( "maven-assembly-plugin", "tmp" ).toFile();
f.deleteOnExit();
diff --git a/src/main/java/org/apache/maven/plugins/assembly/filter/SimpleAggregatingDescriptorHandler.java b/src/main/java/org/apache/maven/plugins/assembly/filter/SimpleAggregatingDescriptorHandler.java
index 4a4d2e79..a0f42049 100644
--- a/src/main/java/org/apache/maven/plugins/assembly/filter/SimpleAggregatingDescriptorHandler.java
+++ b/src/main/java/org/apache/maven/plugins/assembly/filter/SimpleAggregatingDescriptorHandler.java
@@ -38,6 +38,7 @@ import java.io.Reader;
import java.io.StringWriter;
import java.io.Writer;
import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
import java.util.ArrayList;
import java.util.Collections;
import java.util.Date;
@@ -97,7 +98,7 @@ public class SimpleAggregatingDescriptorHandler implements ContainerDescriptorHa
File f;
try
{
- f = File.createTempFile( "maven-assembly-plugin", "tmp" );
+ f = Files.createTempFile( "maven-assembly-plugin", "tmp" ).toFile();
f.deleteOnExit();
try ( Writer writer = getWriter( f ) )
diff --git a/src/main/java/org/apache/maven/plugins/assembly/io/URLLocation.java b/src/main/java/org/apache/maven/plugins/assembly/io/URLLocation.java
index 9c3ebca5..b7a22972 100644
--- a/src/main/java/org/apache/maven/plugins/assembly/io/URLLocation.java
+++ b/src/main/java/org/apache/maven/plugins/assembly/io/URLLocation.java
@@ -22,6 +22,7 @@ package org.apache.maven.plugins.assembly.io;
import java.io.File;
import java.io.IOException;
import java.net.URL;
+import java.nio.file.Files;
import org.apache.commons.io.IOUtils;
@@ -65,7 +66,7 @@ class URLLocation
{
if ( unsafeGetFile() == null )
{
- File tempFile = File.createTempFile( tempFilePrefix, tempFileSuffix );
+ File tempFile = Files.createTempFile( tempFilePrefix, tempFileSuffix ).toFile();
if ( tempFileDeleteOnExit )
{
diff --git a/src/test/java/org/apache/maven/plugins/assembly/io/DefaultAssemblyReaderTest.java b/src/test/java/org/apache/maven/plugins/assembly/io/DefaultAssemblyReaderTest.java
index ccc1a771..ff1a0581 100644
--- a/src/test/java/org/apache/maven/plugins/assembly/io/DefaultAssemblyReaderTest.java
+++ b/src/test/java/org/apache/maven/plugins/assembly/io/DefaultAssemblyReaderTest.java
@@ -96,7 +96,7 @@ public class DefaultAssemblyReaderTest
public void testIncludeSiteInAssembly_ShouldFailIfSiteDirectoryNonExistent()
throws Exception
{
- final File siteDir = File.createTempFile( "assembly-reader.", ".test" );
+ final File siteDir = Files.createTempFile( "assembly-reader.", ".test" ).toFile();
siteDir.delete();
when( configSource.getSiteDirectory() ).thenReturn( siteDir );
diff --git a/src/test/java/org/apache/maven/plugins/assembly/utils/LineEndingsUtilsTest.java b/src/test/java/org/apache/maven/plugins/assembly/utils/LineEndingsUtilsTest.java
index 83b919a5..fa9ab315 100644
--- a/src/test/java/org/apache/maven/plugins/assembly/utils/LineEndingsUtilsTest.java
+++ b/src/test/java/org/apache/maven/plugins/assembly/utils/LineEndingsUtilsTest.java
@@ -29,6 +29,7 @@ import java.io.FileWriter;
import java.io.IOException;
import java.io.StringReader;
import java.io.StringWriter;
+import java.nio.file.Files;
import static org.junit.Assert.assertEquals;
import static org.junit.Assert.assertNull;
@@ -262,9 +263,9 @@ public class LineEndingsUtilsTest
private void testConversion( String test, String check, LineEndings lineEndingChars, Boolean eof )
throws IOException
{
- File source = File.createTempFile( "line-conversion-test-in.", "" );
+ File source = Files.createTempFile( "line-conversion-test-in.", "" ).toFile();
source.deleteOnExit();
- File dest = File.createTempFile( "line-conversion-test-out.", "" );
+ File dest = Files.createTempFile( "line-conversion-test-out.", "" ).toFile();
dest.deleteOnExit();
FileWriter sourceWriter = null;