You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@commons.apache.org by ki...@apache.org on 2022/11/19 10:03:43 UTC

[commons-imaging] branch master updated: vuln-fix: Temporary File Information Disclosure

This is an automated email from the ASF dual-hosted git repository.

kinow pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/commons-imaging.git


The following commit(s) were added to refs/heads/master by this push:
     new b5026706 vuln-fix: Temporary File Information Disclosure
b5026706 is described below

commit b5026706fa6811353a8b53ece95d89f349b81bd1
Author: Jonathan Leitschuh <Jo...@gmail.com>
AuthorDate: Sat Nov 19 02:09:31 2022 +0000

    vuln-fix: Temporary File Information Disclosure
    
    
    
    This fixes temporary file information disclosure vulnerability due to the use
    of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by
    using the `Files.createTempFile()` method which sets the correct posix permissions.
    
    Weakness: CWE-377: Insecure Temporary File
    Severity: Medium
    CVSSS: 5.5
    Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)
    
    Reported-by: Jonathan Leitschuh <Jo...@gmail.com>
    Signed-off-by: Jonathan Leitschuh <Jo...@gmail.com>
    
    Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18
    
    
    Co-authored-by: Moderne <te...@moderne.io>
---
 .../commons/imaging/common/bytesource/ByteSourceTest.java     |  5 +++--
 .../apache/commons/imaging/formats/bmp/BmpRoundtripTest.java  |  3 ++-
 .../commons/imaging/formats/icns/IcnsRoundTripTest.java       |  3 ++-
 .../apache/commons/imaging/formats/ico/IcoRoundtripTest.java  |  3 ++-
 .../commons/imaging/formats/jpeg/exif/ExifRewriteTest.java    |  9 +++++----
 .../formats/jpeg/exif/WriteExifMetadataExampleTest.java       |  3 ++-
 .../apache/commons/imaging/formats/jpeg/iptc/IptcAddTest.java |  3 ++-
 .../commons/imaging/formats/jpeg/iptc/IptcUpdateTest.java     | 11 ++++++-----
 .../commons/imaging/formats/jpeg/xmp/JpegXmpRewriteTest.java  |  7 ++++---
 .../commons/imaging/formats/png/ConvertPngToGifTest.java      |  3 ++-
 .../commons/imaging/formats/png/PngMultipleRoundtripTest.java |  3 ++-
 .../org/apache/commons/imaging/formats/png/PngTextTest.java   |  3 ++-
 .../imaging/formats/png/PngWriteForceTrueColorText.java       |  3 ++-
 .../commons/imaging/formats/png/PngWritePredictorTest.java    |  4 +++-
 .../apache/commons/imaging/formats/png/PngWriteReadTest.java  |  5 +++--
 .../commons/imaging/formats/tiff/TiffRoundtripTest.java       |  3 ++-
 .../org/apache/commons/imaging/formats/xmp/XmpUpdateTest.java |  3 ++-
 .../imaging/roundtrip/NullParametersRoundtripTest.java        |  3 ++-
 .../commons/imaging/roundtrip/PixelDensityRoundtrip.java      |  3 ++-
 .../org/apache/commons/imaging/roundtrip/RoundtripBase.java   |  7 ++++---
 20 files changed, 54 insertions(+), 33 deletions(-)

diff --git a/src/test/java/org/apache/commons/imaging/common/bytesource/ByteSourceTest.java b/src/test/java/org/apache/commons/imaging/common/bytesource/ByteSourceTest.java
index bce417df..4e7792cd 100644
--- a/src/test/java/org/apache/commons/imaging/common/bytesource/ByteSourceTest.java
+++ b/src/test/java/org/apache/commons/imaging/common/bytesource/ByteSourceTest.java
@@ -24,6 +24,7 @@ import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.nio.file.Files;
 
 import org.apache.commons.imaging.ImagingConstants;
 import org.apache.commons.imaging.ImagingTest;
@@ -32,7 +33,7 @@ import org.junit.jupiter.api.Test;
 
 public abstract class ByteSourceTest extends ImagingTest {
     protected File createTempFile(final byte[] src) throws IOException {
-        final File file = File.createTempFile("raw_", ".bin");
+        final File file = Files.createTempFile("raw_", ".bin").toFile();
 
         // write test bytes to file.
         try (FileOutputStream fos = new FileOutputStream(file); OutputStream os = new BufferedOutputStream(fos)) {
@@ -74,4 +75,4 @@ public abstract class ByteSourceTest extends ImagingTest {
         Assertions.assertThrows(NullPointerException.class, () -> byteSourceArray.getInputStream(0L));
     }
 
-}
\ No newline at end of file
+}
diff --git a/src/test/java/org/apache/commons/imaging/formats/bmp/BmpRoundtripTest.java b/src/test/java/org/apache/commons/imaging/formats/bmp/BmpRoundtripTest.java
index 3348af07..83bb04e5 100644
--- a/src/test/java/org/apache/commons/imaging/formats/bmp/BmpRoundtripTest.java
+++ b/src/test/java/org/apache/commons/imaging/formats/bmp/BmpRoundtripTest.java
@@ -28,6 +28,7 @@ import org.junit.jupiter.api.Test;
 import java.awt.image.BufferedImage;
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Random;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -139,7 +140,7 @@ public class BmpRoundtripTest extends BmpBaseTest {
 
         final byte[] bytes = Imaging.writeImageToBytes(srcImage, ImageFormats.BMP);
 
-        final File tempFile = File.createTempFile("temp", ".bmp");
+        final File tempFile = Files.createTempFile("temp", ".bmp").toFile();
         FileUtils.writeByteArrayToFile(tempFile, bytes);
 
         final BufferedImage dstImage = Imaging.getBufferedImage(bytes);
diff --git a/src/test/java/org/apache/commons/imaging/formats/icns/IcnsRoundTripTest.java b/src/test/java/org/apache/commons/imaging/formats/icns/IcnsRoundTripTest.java
index cc02b932..7d3b7a92 100644
--- a/src/test/java/org/apache/commons/imaging/formats/icns/IcnsRoundTripTest.java
+++ b/src/test/java/org/apache/commons/imaging/formats/icns/IcnsRoundTripTest.java
@@ -26,6 +26,7 @@ import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
 import java.nio.ByteOrder;
+import java.nio.file.Files;
 
 import org.apache.commons.imaging.ImageReadException;
 import org.apache.commons.imaging.Imaging;
@@ -408,7 +409,7 @@ public class IcnsRoundTripTest extends IcnsBaseTest {
     private void writeAndReadImageData(final String description, final byte[] rawData,
             final int foreground, final int background) throws IOException,
             ImageReadException {
-        final File exportFile = File.createTempFile(description, ".icns");
+        final File exportFile = Files.createTempFile(description, ".icns").toFile();
         FileUtils.writeByteArrayToFile(exportFile, rawData);
         final BufferedImage dstImage = Imaging.getBufferedImage(exportFile);
 
diff --git a/src/test/java/org/apache/commons/imaging/formats/ico/IcoRoundtripTest.java b/src/test/java/org/apache/commons/imaging/formats/ico/IcoRoundtripTest.java
index fb8a136b..5c25d519 100644
--- a/src/test/java/org/apache/commons/imaging/formats/ico/IcoRoundtripTest.java
+++ b/src/test/java/org/apache/commons/imaging/formats/ico/IcoRoundtripTest.java
@@ -26,6 +26,7 @@ import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
 import java.nio.ByteOrder;
+import java.nio.file.Files;
 import java.util.HashMap;
 import java.util.Map;
 
@@ -538,7 +539,7 @@ public class IcoRoundtripTest extends IcoBaseTest {
         // File exportFile = new File("/tmp/" + description + ".ico");
         // IoUtils.writeToFile(rawData, exportFile);
 
-        final File tempFile = File.createTempFile("temp", ".ico");
+        final File tempFile = Files.createTempFile("temp", ".ico").toFile();
         FileUtils.writeByteArrayToFile(tempFile, rawData);
 
         final BufferedImage dstImage = Imaging.getBufferedImage(tempFile);
diff --git a/src/test/java/org/apache/commons/imaging/formats/jpeg/exif/ExifRewriteTest.java b/src/test/java/org/apache/commons/imaging/formats/jpeg/exif/ExifRewriteTest.java
index 13ec8700..673d744c 100644
--- a/src/test/java/org/apache/commons/imaging/formats/jpeg/exif/ExifRewriteTest.java
+++ b/src/test/java/org/apache/commons/imaging/formats/jpeg/exif/ExifRewriteTest.java
@@ -27,6 +27,7 @@ import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.HashSet;
@@ -83,7 +84,7 @@ public class ExifRewriteTest extends ExifBaseTest {
                 final ByteArrayOutputStream baos = new ByteArrayOutputStream();
                 new ExifRewriter().removeExifMetadata(byteSource, baos);
                 final byte[] bytes = baos.toByteArray();
-                final File tempFile = File.createTempFile("test", ".jpg");
+                final File tempFile = Files.createTempFile("test", ".jpg").toFile();
                 Debug.debug("tempFile", tempFile);
                 FileUtils.writeByteArrayToFile(tempFile, bytes);
 
@@ -122,7 +123,7 @@ public class ExifRewriteTest extends ExifBaseTest {
                 final ByteArrayOutputStream baos = new ByteArrayOutputStream();
                 new ExifRewriter().removeExifMetadata(byteSource, baos);
                 final byte[] bytes = baos.toByteArray();
-                final File tempFile = File.createTempFile("removed", ".jpg");
+                final File tempFile = Files.createTempFile("removed", ".jpg").toFile();
                 Debug.debug("tempFile", tempFile);
                 FileUtils.writeByteArrayToFile(tempFile, bytes);
 
@@ -143,7 +144,7 @@ public class ExifRewriteTest extends ExifBaseTest {
                         outputSet);
 
                 final byte[] bytes = baos.toByteArray();
-                final File tempFile = File.createTempFile("inserted" + "_", ".jpg");
+                final File tempFile = Files.createTempFile("inserted" + "_", ".jpg").toFile();
                 Debug.debug("tempFile", tempFile);
                 FileUtils.writeByteArrayToFile(tempFile, bytes);
 
@@ -210,7 +211,7 @@ public class ExifRewriteTest extends ExifBaseTest {
                 final ByteArrayOutputStream baos = new ByteArrayOutputStream();
                 rewriter.rewrite(byteSource, baos, outputSet);
                 final byte[] bytes = baos.toByteArray();
-                final File tempFile = File.createTempFile(name + "_", ".jpg");
+                final File tempFile = Files.createTempFile(name + "_", ".jpg").toFile();
                 Debug.debug("tempFile", tempFile);
                 FileUtils.writeByteArrayToFile(tempFile, bytes);
 
diff --git a/src/test/java/org/apache/commons/imaging/formats/jpeg/exif/WriteExifMetadataExampleTest.java b/src/test/java/org/apache/commons/imaging/formats/jpeg/exif/WriteExifMetadataExampleTest.java
index 5159d65d..d04425a3 100644
--- a/src/test/java/org/apache/commons/imaging/formats/jpeg/exif/WriteExifMetadataExampleTest.java
+++ b/src/test/java/org/apache/commons/imaging/formats/jpeg/exif/WriteExifMetadataExampleTest.java
@@ -20,6 +20,7 @@ package org.apache.commons.imaging.formats.jpeg.exif;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
 import java.io.File;
+import java.nio.file.Files;
 import java.util.stream.Stream;
 
 import org.apache.commons.imaging.common.bytesource.ByteSourceFile;
@@ -46,7 +47,7 @@ public class WriteExifMetadataExampleTest extends ExifBaseTest {
     public void testOddOffsets(final File imageFile) throws Exception {
         Debug.debug("imageFile", imageFile.getAbsoluteFile());
 
-        final File tempFile = File.createTempFile("test", ".jpg");
+        final File tempFile = Files.createTempFile("test", ".jpg").toFile();
         Debug.debug("tempFile", tempFile.getAbsoluteFile());
 
         try {
diff --git a/src/test/java/org/apache/commons/imaging/formats/jpeg/iptc/IptcAddTest.java b/src/test/java/org/apache/commons/imaging/formats/jpeg/iptc/IptcAddTest.java
index fec6e2cf..32d9f604 100644
--- a/src/test/java/org/apache/commons/imaging/formats/jpeg/iptc/IptcAddTest.java
+++ b/src/test/java/org/apache/commons/imaging/formats/jpeg/iptc/IptcAddTest.java
@@ -24,6 +24,7 @@ import java.io.BufferedOutputStream;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.OutputStream;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.stream.Stream;
@@ -75,7 +76,7 @@ public class IptcAddTest extends IptcBaseTest {
 
         final PhotoshopApp13Data newData = new PhotoshopApp13Data(newRecords, newBlocks);
 
-        final File updated = File.createTempFile(imageFile.getName() + ".iptc.add.", ".jpg");
+        final File updated = Files.createTempFile(imageFile.getName() + ".iptc.add.", ".jpg").toFile();
         try (FileOutputStream fos = new FileOutputStream(updated);
                 OutputStream os = new BufferedOutputStream(fos)) {
             new JpegIptcRewriter().writeIPTC(byteSource, os, newData);
diff --git a/src/test/java/org/apache/commons/imaging/formats/jpeg/iptc/IptcUpdateTest.java b/src/test/java/org/apache/commons/imaging/formats/jpeg/iptc/IptcUpdateTest.java
index b5079058..4545f687 100644
--- a/src/test/java/org/apache/commons/imaging/formats/jpeg/iptc/IptcUpdateTest.java
+++ b/src/test/java/org/apache/commons/imaging/formats/jpeg/iptc/IptcUpdateTest.java
@@ -26,6 +26,7 @@ import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.List;
 import java.util.stream.Stream;
@@ -71,7 +72,7 @@ public class IptcUpdateTest extends IptcBaseTest {
     }
 
     public File removeIptc(final ByteSource byteSource, final File imageFile) throws Exception {
-        final File noIptcFile = File.createTempFile(imageFile.getName() + ".iptc.remove.", ".jpg");
+        final File noIptcFile = Files.createTempFile(imageFile.getName() + ".iptc.remove.", ".jpg").toFile();
 
         try (OutputStream os = new BufferedOutputStream(new FileOutputStream(noIptcFile))) {
             new JpegIptcRewriter().removeIPTC(byteSource, os);
@@ -102,8 +103,8 @@ public class IptcUpdateTest extends IptcBaseTest {
         final PhotoshopApp13Data newData = new PhotoshopApp13Data(newRecords,
                 newBlocks);
 
-        final File updated = File.createTempFile(imageFile.getName()
-                + ".iptc.insert.", ".jpg");
+        final File updated = Files.createTempFile(imageFile.getName()
+                + ".iptc.insert.", ".jpg").toFile();
         try (FileOutputStream fos = new FileOutputStream(updated);
                 OutputStream os = new BufferedOutputStream(fos)) {
             new JpegIptcRewriter().writeIPTC(new ByteSourceFile(
@@ -149,8 +150,8 @@ public class IptcUpdateTest extends IptcBaseTest {
     }
 
     public File writeIptc(final ByteSource byteSource, final PhotoshopApp13Data newData, final File imageFile) throws IOException, ImageReadException, ImageWriteException {
-        final File updated = File.createTempFile(imageFile.getName()
-                + ".iptc.update.", ".jpg");
+        final File updated = Files.createTempFile(imageFile.getName()
+                + ".iptc.update.", ".jpg").toFile();
         try (FileOutputStream fos = new FileOutputStream(updated);
                 OutputStream os = new BufferedOutputStream(fos)) {
             new JpegIptcRewriter().writeIPTC(byteSource, os, newData);
diff --git a/src/test/java/org/apache/commons/imaging/formats/jpeg/xmp/JpegXmpRewriteTest.java b/src/test/java/org/apache/commons/imaging/formats/jpeg/xmp/JpegXmpRewriteTest.java
index 7087e158..9fd4a349 100644
--- a/src/test/java/org/apache/commons/imaging/formats/jpeg/xmp/JpegXmpRewriteTest.java
+++ b/src/test/java/org/apache/commons/imaging/formats/jpeg/xmp/JpegXmpRewriteTest.java
@@ -24,6 +24,7 @@ import java.io.BufferedOutputStream;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.OutputStream;
+import java.nio.file.Files;
 import java.util.stream.Stream;
 
 import org.apache.commons.imaging.common.bytesource.ByteSource;
@@ -48,7 +49,7 @@ public class JpegXmpRewriteTest extends JpegXmpBaseTest {
         final String xmpXml = new JpegImageParser().getXmpXml(byteSource, params);
         assertNotNull(xmpXml);
 
-        final File noXmpFile = File.createTempFile(imageFile.getName() + ".", ".jpg");
+        final File noXmpFile = Files.createTempFile(imageFile.getName() + ".", ".jpg").toFile();
         {
             // test remove
 
@@ -69,7 +70,7 @@ public class JpegXmpRewriteTest extends JpegXmpBaseTest {
             // test update
 
             final String newXmpXml = "test";
-            final File updated = File.createTempFile(imageFile.getName() + ".", ".jpg");
+            final File updated = Files.createTempFile(imageFile.getName() + ".", ".jpg").toFile();
             try (FileOutputStream fos = new FileOutputStream(updated);
                     OutputStream os = new BufferedOutputStream(fos)) {
                 new JpegXmpRewriter().updateXmpXml(byteSource, os, newXmpXml);
@@ -88,7 +89,7 @@ public class JpegXmpRewriteTest extends JpegXmpBaseTest {
             // test insert
 
             final String newXmpXml = "test";
-            final File updated = File.createTempFile(imageFile.getName() + ".", ".jpg");
+            final File updated = Files.createTempFile(imageFile.getName() + ".", ".jpg").toFile();
             try (FileOutputStream fos = new FileOutputStream(updated);
                     OutputStream os = new BufferedOutputStream(fos)) {
                 new JpegXmpRewriter().updateXmpXml(new ByteSourceFile(
diff --git a/src/test/java/org/apache/commons/imaging/formats/png/ConvertPngToGifTest.java b/src/test/java/org/apache/commons/imaging/formats/png/ConvertPngToGifTest.java
index c4da1645..6b419569 100644
--- a/src/test/java/org/apache/commons/imaging/formats/png/ConvertPngToGifTest.java
+++ b/src/test/java/org/apache/commons/imaging/formats/png/ConvertPngToGifTest.java
@@ -24,6 +24,7 @@ import org.junit.jupiter.api.Test;
 
 import java.awt.image.BufferedImage;
 import java.io.File;
+import java.nio.file.Files;
 import java.util.List;
 
 import static org.junit.jupiter.api.Assertions.assertNotNull;
@@ -44,7 +45,7 @@ public class ConvertPngToGifTest extends PngBaseTest {
             final BufferedImage image = Imaging.getBufferedImage(imageFile);
             assertNotNull(image);
 
-            final File outFile = File.createTempFile(imageFile.getName() + ".", ".gif");
+            final File outFile = Files.createTempFile(imageFile.getName() + ".", ".gif").toFile();
 
             Imaging.writeImage(image, outFile, ImageFormats.GIF);
         }
diff --git a/src/test/java/org/apache/commons/imaging/formats/png/PngMultipleRoundtripTest.java b/src/test/java/org/apache/commons/imaging/formats/png/PngMultipleRoundtripTest.java
index 95c545e3..39eb192d 100644
--- a/src/test/java/org/apache/commons/imaging/formats/png/PngMultipleRoundtripTest.java
+++ b/src/test/java/org/apache/commons/imaging/formats/png/PngMultipleRoundtripTest.java
@@ -25,6 +25,7 @@ import org.junit.jupiter.api.Test;
 
 import java.awt.image.BufferedImage;
 import java.io.File;
+import java.nio.file.Files;
 
 import static org.junit.jupiter.api.Assertions.assertNotNull;
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -56,7 +57,7 @@ public class PngMultipleRoundtripTest extends PngBaseTest {
                 final BufferedImage image = Imaging.getBufferedImage(lastFile);
                 assertNotNull(image);
 
-                final File tempFile = File.createTempFile(imageFile.getName() + "." + j + ".", ".png");
+                final File tempFile = Files.createTempFile(imageFile.getName() + "." + j + ".", ".png").toFile();
                 Debug.debug("tempFile", tempFile);
 
                 Imaging.writeImage(image, tempFile, ImageFormats.PNG);
diff --git a/src/test/java/org/apache/commons/imaging/formats/png/PngTextTest.java b/src/test/java/org/apache/commons/imaging/formats/png/PngTextTest.java
index 057ebdc5..f1108b06 100644
--- a/src/test/java/org/apache/commons/imaging/formats/png/PngTextTest.java
+++ b/src/test/java/org/apache/commons/imaging/formats/png/PngTextTest.java
@@ -25,6 +25,7 @@ import java.awt.Color;
 import java.awt.image.BufferedImage;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.List;
 
@@ -73,7 +74,7 @@ public class PngTextTest extends PngBaseTest {
             bytes = baos.toByteArray();
         }
 
-        final File tempFile = File.createTempFile("temp", ".png");
+        final File tempFile = Files.createTempFile("temp", ".png").toFile();
         FileUtils.writeByteArrayToFile(tempFile, bytes);
 
         final PngImageInfo imageInfo = (PngImageInfo) Imaging.getImageInfo(bytes);
diff --git a/src/test/java/org/apache/commons/imaging/formats/png/PngWriteForceTrueColorText.java b/src/test/java/org/apache/commons/imaging/formats/png/PngWriteForceTrueColorText.java
index 3224d4a8..0bd0a7b9 100644
--- a/src/test/java/org/apache/commons/imaging/formats/png/PngWriteForceTrueColorText.java
+++ b/src/test/java/org/apache/commons/imaging/formats/png/PngWriteForceTrueColorText.java
@@ -23,6 +23,7 @@ import org.junit.jupiter.api.Test;
 import java.awt.image.BufferedImage;
 import java.io.File;
 import java.io.FileOutputStream;
+import java.nio.file.Files;
 import java.util.List;
 
 import static org.junit.jupiter.api.Assertions.assertNotNull;
@@ -49,7 +50,7 @@ public class PngWriteForceTrueColorText extends PngBaseTest {
                 final BufferedImage image = pngImageParser.getBufferedImage(imageFile, new PngImagingParameters());
                 assertNotNull(image);
 
-                final File outFile = File.createTempFile(imageFile.getName() + ".", ".gif");
+                final File outFile = Files.createTempFile(imageFile.getName() + ".", ".gif").toFile();
                 // Debug.debug("outFile", outFile);
 
                 final PngImagingParameters params = new PngImagingParameters();
diff --git a/src/test/java/org/apache/commons/imaging/formats/png/PngWritePredictorTest.java b/src/test/java/org/apache/commons/imaging/formats/png/PngWritePredictorTest.java
index 4641a387..5f0a8629 100644
--- a/src/test/java/org/apache/commons/imaging/formats/png/PngWritePredictorTest.java
+++ b/src/test/java/org/apache/commons/imaging/formats/png/PngWritePredictorTest.java
@@ -24,6 +24,8 @@ import java.io.BufferedOutputStream;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
+import java.nio.file.Files;
+
 import javax.imageio.ImageIO;
 import org.apache.commons.imaging.ImageWriteException;
 import org.junit.jupiter.api.BeforeEach;
@@ -86,7 +88,7 @@ public class PngWritePredictorTest {
     File tempFile = null;
 
     try {
-      tempFile = File.createTempFile("PngWritePredictorRGB", ".png");
+      tempFile = Files.createTempFile("PngWritePredictorRGB", ".png").toFile();
     } catch (final IOException ioex) {
       fail("Failed to create temporary file, " + ioex.getMessage());
     }
diff --git a/src/test/java/org/apache/commons/imaging/formats/png/PngWriteReadTest.java b/src/test/java/org/apache/commons/imaging/formats/png/PngWriteReadTest.java
index e7668893..6ccede69 100644
--- a/src/test/java/org/apache/commons/imaging/formats/png/PngWriteReadTest.java
+++ b/src/test/java/org/apache/commons/imaging/formats/png/PngWriteReadTest.java
@@ -31,6 +31,7 @@ import java.awt.image.BufferedImage;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.LinkedList;
 import java.util.List;
 import java.util.Random;
@@ -182,7 +183,7 @@ public class PngWriteReadTest extends ImagingTest {
 
         final byte[] bytes = Imaging.writeImageToBytes(srcImage, ImageFormats.PNG);
 
-        final File tempFile = File.createTempFile("temp", ".png");
+        final File tempFile = Files.createTempFile("temp", ".png").toFile();
         FileUtils.writeByteArrayToFile(tempFile, bytes);
 
         final BufferedImage dstImage = Imaging.getBufferedImage(bytes);
@@ -212,7 +213,7 @@ public class PngWriteReadTest extends ImagingTest {
             bytes = os.toByteArray();
         }
 
-        final File tempFile = File.createTempFile("temp", ".png");
+        final File tempFile = Files.createTempFile("temp", ".png").toFile();
         FileUtils.writeByteArrayToFile(tempFile, bytes);
 
         final BufferedImage dstImage = Imaging.getBufferedImage(bytes);
diff --git a/src/test/java/org/apache/commons/imaging/formats/tiff/TiffRoundtripTest.java b/src/test/java/org/apache/commons/imaging/formats/tiff/TiffRoundtripTest.java
index ee2f2bbe..c33a2db1 100644
--- a/src/test/java/org/apache/commons/imaging/formats/tiff/TiffRoundtripTest.java
+++ b/src/test/java/org/apache/commons/imaging/formats/tiff/TiffRoundtripTest.java
@@ -27,6 +27,7 @@ import org.junit.jupiter.api.Test;
 import java.awt.image.BufferedImage;
 import java.io.File;
 import java.io.FileOutputStream;
+import java.nio.file.Files;
 import java.util.List;
 
 import static org.junit.jupiter.api.Assertions.assertNotNull;
@@ -57,7 +58,7 @@ public class TiffRoundtripTest extends TiffBaseTest {
             };
             final TiffImageParser tiffImageParser = new TiffImageParser();
             for (final int compression : compressions) {
-                final File tempFile = File.createTempFile(imageFile.getName() + "-" + compression + ".", ".tif");
+                final File tempFile = Files.createTempFile(imageFile.getName() + "-" + compression + ".", ".tif").toFile();
                 final TiffImagingParameters params = new TiffImagingParameters();
                 params.setCompression(compression);
                 try (FileOutputStream fos = new FileOutputStream(tempFile)) {
diff --git a/src/test/java/org/apache/commons/imaging/formats/xmp/XmpUpdateTest.java b/src/test/java/org/apache/commons/imaging/formats/xmp/XmpUpdateTest.java
index fd62e03f..a662b45c 100644
--- a/src/test/java/org/apache/commons/imaging/formats/xmp/XmpUpdateTest.java
+++ b/src/test/java/org/apache/commons/imaging/formats/xmp/XmpUpdateTest.java
@@ -30,6 +30,7 @@ import org.junit.jupiter.api.Test;
 import java.awt.image.BufferedImage;
 import java.io.File;
 import java.io.FileOutputStream;
+import java.nio.file.Files;
 import java.util.List;
 
 import static org.junit.jupiter.api.Assertions.assertEquals;
@@ -64,7 +65,7 @@ public class XmpUpdateTest extends ImagingTest {
                 continue;
             }
 
-            final File tempFile = File.createTempFile(imageFile.getName() + ".", "." + imageFormat.getDefaultExtension());
+            final File tempFile = Files.createTempFile(imageFile.getName() + ".", "." + imageFormat.getDefaultExtension()).toFile();
             final BufferedImage image = Imaging.getBufferedImage(imageFile);
 
             final ImageParser parser = Util.getImageParser("." + imageFormat.getDefaultExtension());
diff --git a/src/test/java/org/apache/commons/imaging/roundtrip/NullParametersRoundtripTest.java b/src/test/java/org/apache/commons/imaging/roundtrip/NullParametersRoundtripTest.java
index 07225909..fc44b2cb 100644
--- a/src/test/java/org/apache/commons/imaging/roundtrip/NullParametersRoundtripTest.java
+++ b/src/test/java/org/apache/commons/imaging/roundtrip/NullParametersRoundtripTest.java
@@ -23,6 +23,7 @@ import org.junit.jupiter.params.provider.MethodSource;
 
 import java.awt.image.BufferedImage;
 import java.io.File;
+import java.nio.file.Files;
 import java.util.stream.Stream;
 
 import static org.junit.jupiter.api.Assertions.assertNotNull;
@@ -37,7 +38,7 @@ public class NullParametersRoundtripTest extends RoundtripBase {
     @MethodSource("data")
     public void testNullParametersRoundtrip(final FormatInfo formatInfo) throws Exception {
         final BufferedImage testImage = TestImages.createFullColorImage(1, 1);
-        final File temp1 = File.createTempFile("nullParameters.", "." + formatInfo.format.getDefaultExtension());
+        final File temp1 = Files.createTempFile("nullParameters.", "." + formatInfo.format.getDefaultExtension()).toFile();
         Imaging.writeImage(testImage, temp1, formatInfo.format);
         Imaging.getImageInfo(temp1);
         Imaging.getImageSize(temp1);
diff --git a/src/test/java/org/apache/commons/imaging/roundtrip/PixelDensityRoundtrip.java b/src/test/java/org/apache/commons/imaging/roundtrip/PixelDensityRoundtrip.java
index f5269f4c..6fdcc4a7 100644
--- a/src/test/java/org/apache/commons/imaging/roundtrip/PixelDensityRoundtrip.java
+++ b/src/test/java/org/apache/commons/imaging/roundtrip/PixelDensityRoundtrip.java
@@ -28,6 +28,7 @@ import org.junit.jupiter.params.provider.MethodSource;
 import java.awt.image.BufferedImage;
 import java.io.ByteArrayOutputStream;
 import java.io.File;
+import java.nio.file.Files;
 import java.util.stream.Stream;
 
 import static org.junit.jupiter.api.Assertions.assertTrue;
@@ -43,7 +44,7 @@ public class PixelDensityRoundtrip extends RoundtripBase {
     public void testPixelDensityRoundtrip(final FormatInfo formatInfo) throws Exception {
         final BufferedImage testImage = TestImages.createFullColorImage(2, 2);
 
-        final File temp1 = File.createTempFile("pixeldensity.", "." + formatInfo.format.getDefaultExtension());
+        final File temp1 = Files.createTempFile("pixeldensity.", "." + formatInfo.format.getDefaultExtension()).toFile();
 
         final TiffImagingParameters params = new TiffImagingParameters();
         final PixelDensity pixelDensity = PixelDensity.createFromPixelsPerInch(75, 150);
diff --git a/src/test/java/org/apache/commons/imaging/roundtrip/RoundtripBase.java b/src/test/java/org/apache/commons/imaging/roundtrip/RoundtripBase.java
index 5a961e4f..a466618a 100644
--- a/src/test/java/org/apache/commons/imaging/roundtrip/RoundtripBase.java
+++ b/src/test/java/org/apache/commons/imaging/roundtrip/RoundtripBase.java
@@ -29,6 +29,7 @@ import java.awt.image.BufferedImage;
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.stream.Stream;
 
 import static org.junit.jupiter.api.Assertions.assertNotNull;
@@ -38,8 +39,8 @@ public class RoundtripBase {
     protected void roundtrip(final FormatInfo formatInfo, final BufferedImage testImage,
                              final String tempPrefix, final boolean imageExact) throws IOException,
             ImageReadException, ImageWriteException {
-        final File temp1 = File.createTempFile(tempPrefix + ".", "."
-                + formatInfo.format.getDefaultExtension());
+        final File temp1 = Files.createTempFile(tempPrefix + ".", "."
+                + formatInfo.format.getDefaultExtension()).toFile();
         Debug.debug("tempFile: " + temp1.getName());
 
         final ImageParser imageParser = Util.getImageParser(formatInfo.format);
@@ -61,7 +62,7 @@ public class RoundtripBase {
         }
 
         if (formatInfo.identicalSecondWrite) {
-            final File temp2 = File.createTempFile(tempPrefix + ".", "." + formatInfo.format.getDefaultExtension());
+            final File temp2 = Files.createTempFile(tempPrefix + ".", "." + formatInfo.format.getDefaultExtension()).toFile();
             try (FileOutputStream fos = new FileOutputStream(temp2)) {
                 imageParser.writeImage(image2, fos, params);
             }