From 0eaca11d1c09de2fbcf203d05e6c0580a0f710b0 Mon Sep 17 00:00:00 2001 From: Jonathan Leitschuh Date: Fri, 18 Nov 2022 22:40:51 +0000 Subject: [PATCH] vuln-fix: Temporary File Information Disclosure This fixes temporary file information disclosure vulnerability due to the use of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by using the `Files.createTempFile()` method which sets the correct posix permissions. Weakness: CWE-377: Insecure Temporary File Severity: Medium CVSSS: 5.5 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation) Reported-by: Jonathan Leitschuh Signed-off-by: Jonathan Leitschuh Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18 Co-authored-by: Moderne --- .../org/apache/maven/plugins/install/InstallFileMojo.java | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/main/java/org/apache/maven/plugins/install/InstallFileMojo.java b/src/main/java/org/apache/maven/plugins/install/InstallFileMojo.java index a006dace..e826a58c 100644 --- a/src/main/java/org/apache/maven/plugins/install/InstallFileMojo.java +++ b/src/main/java/org/apache/maven/plugins/install/InstallFileMojo.java @@ -340,7 +340,7 @@ private File readingPomFromJarFile() { base = base.substring( 0, base.lastIndexOf( '.' ) ); } - pomFile = File.createTempFile( base, ".pom" ); + pomFile = Files.createTempFile( base, ".pom" ).toFile(); pomOutputStream = Files.newOutputStream( pomFile.toPath() ); @@ -498,7 +498,7 @@ private File generatePomFile() Writer writer = null; try { - File pomFile = File.createTempFile( "mvninstall", ".pom" ); + File pomFile = Files.createTempFile( "mvninstall", ".pom" ).toFile(); writer = new XmlStreamWriter( pomFile ); new MavenXpp3Writer().write( writer, model );