You are viewing a plain text version of this content. The canonical link for it is here.
Posted to issues@flink.apache.org by "Samrat002 (via GitHub)" <gi...@apache.org> on 2026/08/12 05:38:43 UTC
[PR] [FLINK-37666] CWE-378: Creation of Temporary File With Insecure Permissions in Temporary File Creation [flink]
Samrat002 opened a new pull request, #28957:
URL: https://github.com/apache/flink/pull/28957
## What is the purpose of the change
`File.createTempFile()` creates temporary files with permissions determined by the OS umask, which on typical POSIX systems yields world-readable permissions (-rw-r--r--, 0644). This means any local user on the same host can read the file's contents for the lifetime of the temp file. Depending on the call site, those contents can be highly sensitive:
- YarnClusterDescriptor — serialized JobGraph and Flink configuration file
- ChangelogStreamHandleReaderWithCache — cached state/changelog data
- PackagedProgram — extracted JAR libraries
The fix replaces File.createTempFile with java.nio.file.Files.createTempFile across all affected sites. On POSIX filesystems, Files.createTempFile applies owner-only permissions (-rw-------, 0600) atomically at creation time — no group or other access, and no read-then-chmod race window.
The security guarantee is POSIX-scoped (on Windows it falls back to directory ACLs, which are per-user by default), but Flink's production targets are POSIX, so the concern is fully addressed where it matters. Using the default-attribute form of Files.createTempFile (rather than passing explicit PosixFilePermissions) is intentional: explicit POSIX attributes throw UnsupportedOperationException on non-POSIX systems, making the default form the more portable choice.
Verifying the permission
```
System.out.println(Files.getPosixFilePermissions(p)); // [OWNER_READ, OWNER_WRITE]
File f = File.createTempFile("t", null);
System.out.println(Files.getPosixFilePermissions(f.toPath())); // [OWNER_READ, OWNER_WRITE, GROUP_READ, OTHERS_READ]
## Brief change log
- PackagedProgram.java - Replaced File.createTempFile with Files.createTempFile in createTempFile method (existing deleteOnExit() retained)
- ChangelogStreamHandleReaderWithCache.java — Replaced File.createTempFile with Files.createTempFile in downloadToCacheFile; added deleteOnExit() for correct cleanup
- StreamWindowSQLExample.java — Replaced File.createTempFile with Files.createTempFile in createTempFile (existing deleteOnExit() retained)
- YarnClusterDescriptor.java — Replaced File.createTempFile with Files.createTempFile in two locations (jobGraph temp file and Flink config temp file); added deleteOnExit() to both for correct cleanup
## Verifying this change
This change is a targeted security hardening / code cleanup. The security property (file permissions) is enforced by the JDK's NIO implementation and not exercised by existing Flink unit tests. No new test coverage is added, as the correct permissions can be verified by inspecting the POSIX attributes of the created file (as shown in the example above), and the surrounding logic is unchanged. Existing tests for the affected classes continue to exercise the same code paths and confirm no behavioral regression.
## Does this pull request potentially affect one of the following parts:
- Dependencies (does it add or upgrade a dependency): (yes / no) no
- The public API, i.e., is any changed class annotated with `@Public(Evolving)`: (yes / no) no
- The serializers: (yes / no / don't know) no
- The runtime per-record code paths (performance sensitive): (yes / no / don't know) no
- Anything that affects deployment or recovery: JobManager (and its components), Checkpointing, Kubernetes/Yarn, ZooKeeper: (yes / no / don't know) no
- The S3 file system connector: (yes / no / don't know) no
## Documentation
- Does this pull request introduce a new feature? (yes / no) no
- If yes, how is the feature documented? (not applicable / docs / JavaDocs / not documented) N/A
---
##### Was generative AI tooling used to co-author this PR?
<!--
If generative AI tooling has been used in the process of authoring this PR, please
change the checkbox below to `[X]` and replace the placeholder in the "Generated-by"
line with the tool name and version. Otherwise remove the "Generated-by" line.
See the ASF Generative Tooling Guidance for details:
https://www.apache.org/legal/generative-tooling.html
You are responsible for the quality and correctness of every change in this PR
regardless of the tooling used. Low-effort AI-generated PRs will be closed. See
AGENTS.md for the full guidance.
-->
- [ ] Yes (please specify the tool below)
Generated-by: [Tool Name and Version]
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37666] CWE-378: Creation of Temporary File With Insecure Permissions in Temporary File Creation [flink]
Posted by "flinkbot (via GitHub)" <gi...@apache.org>.
flinkbot commented on PR #28957:
URL: https://github.com/apache/flink/pull/28957#issuecomment-5262853999
<!--
Meta data
{
"version" : 1,
"metaDataEntries" : [ {
"hash" : "fab41ce35ab324e487d5fa6a2c2409e57a30caed",
"status" : "UNKNOWN",
"url" : "TBD",
"triggerID" : "fab41ce35ab324e487d5fa6a2c2409e57a30caed",
"triggerType" : "PUSH"
} ]
}-->
## CI report:
* fab41ce35ab324e487d5fa6a2c2409e57a30caed UNKNOWN
<details>
<summary>Bot commands</summary>
The @flinkbot bot supports the following commands:
- `@flinkbot run azure` re-run the last Azure build
</details>
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37666] CWE-378: Creation of Temporary File With Insecure Permissions in Temporary File Creation [flink]
Posted by "Samrat002 (via GitHub)" <gi...@apache.org>.
Samrat002 commented on code in PR #28957:
URL: https://github.com/apache/flink/pull/28957#discussion_r3878575907
##########
flink-dstl/flink-dstl-dfs/src/main/java/org/apache/flink/changelog/fs/ChangelogStreamHandleReaderWithCache.java:
##########
@@ -128,7 +128,8 @@ private RefCountedFile downloadToCacheFile(FileStateHandle fileHandle) {
File directory = cacheDirectories[next.getAndIncrement() % cacheDirectories.length];
File file;
try {
- file = File.createTempFile(CACHE_FILE_PREFIX, null, directory);
+ file = Files.createTempFile(directory.toPath(), CACHE_FILE_PREFIX, null).toFile();
+ file.deleteOnExit();
Review Comment:
yeah . true, it will accumulate. I have removed it and updated the patch.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37666] CWE-378: Creation of Temporary File With Insecure Permissions in Temporary File Creation [flink]
Posted by "rkhachatryan (via GitHub)" <gi...@apache.org>.
rkhachatryan commented on code in PR #28957:
URL: https://github.com/apache/flink/pull/28957#discussion_r3785824325
##########
flink-dstl/flink-dstl-dfs/src/main/java/org/apache/flink/changelog/fs/ChangelogStreamHandleReaderWithCache.java:
##########
@@ -128,7 +128,8 @@ private RefCountedFile downloadToCacheFile(FileStateHandle fileHandle) {
File directory = cacheDirectories[next.getAndIncrement() % cacheDirectories.length];
File file;
try {
- file = File.createTempFile(CACHE_FILE_PREFIX, null, directory);
+ file = Files.createTempFile(directory.toPath(), CACHE_FILE_PREFIX, null).toFile();
+ file.deleteOnExit();
Review Comment:
Can we rather delete the file explicitly?
I'm concerned that the number of such files to delete will accumulate in a long running JVM process
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37666] CWE-378: Creation of Temporary File With Insecure Permissions in Temporary File Creation [flink]
Posted by "Samrat002 (via GitHub)" <gi...@apache.org>.
Samrat002 commented on PR #28957:
URL: https://github.com/apache/flink/pull/28957#issuecomment-5289625320
@rkhachatryan PTAL whenever time
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] [FLINK-37666] CWE-378: Creation of Temporary File With Insecure Permissions in Temporary File Creation [flink]
Posted by "rkhachatryan (via GitHub)" <gi...@apache.org>.
rkhachatryan merged PR #28957:
URL: https://github.com/apache/flink/pull/28957
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: issues-unsubscribe@flink.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org