[GitHub] [maven-assembly-plugin] hboutemy commented on a diff in pull request #99: [SECURITY] Fix Temporary File Information Disclosure Vulnerability

["hboutemy (via GitHub)" <gi...@apache.org>]

hboutemy commented on code in PR #99:
URL: https://github.com/apache/maven-assembly-plugin/pull/99#discussion_r1045206028


##########
src/test/java/org/apache/maven/plugins/assembly/io/DefaultAssemblyReaderTest.java:
##########
@@ -96,7 +96,7 @@ public void setUp()
     public void testIncludeSiteInAssembly_ShouldFailIfSiteDirectoryNonExistent()
         throws Exception
     {
-        final File siteDir = File.createTempFile( "assembly-reader.", ".test" );
+        final File siteDir = Files.createTempFile( "assembly-reader.", ".test" ).toFile();

Review Comment:
   this one happens in plugin's unit test: nothing sensitive here



##########
src/test/java/org/apache/maven/plugins/assembly/utils/LineEndingsUtilsTest.java:
##########
@@ -262,9 +263,9 @@ public void testConvertLineEndings_CRLFToLFWithEOFStripEOF()
     private void testConversion( String test, String check, LineEndings lineEndingChars, Boolean eof )
         throws IOException
     {
-        File source = File.createTempFile( "line-conversion-test-in.", "" );
+        File source = Files.createTempFile( "line-conversion-test-in.", "" ).toFile();

Review Comment:
   this one happens in plugin's unit test: nothing sensitive here
   



##########
src/main/java/org/apache/maven/plugins/assembly/filter/ComponentsXmlArchiverFileFilter.java:
##########
@@ -102,7 +102,7 @@ private void addToArchive( final Archiver archiver )
     {
         if ( components != null )
         {
-            final File f = File.createTempFile( "maven-assembly-plugin", "tmp" );

Review Comment:
   ok, content of META-INF/plexus/components.xml can be read when merging: nothing sensitive



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: issues-unsubscribe@maven.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org