Skip to content

Commit e3ecec5

Browse files
JLLeitschuhTeamModerne
JLLeitschuh
and
TeamModerne
committed
vuln-fix: Temporary File Information Disclosure
This fixes temporary file information disclosure vulnerability due to the use of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by using the `Files.createTempFile()` method which sets the correct posix permissions. Weakness: CWE-377: Insecure Temporary File Severity: Medium CVSSS: 5.5 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation) Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com> Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com> Bug-tracker: JLLeitschuh/security-research#18 Co-authored-by: Moderne <team@moderne.io>
1 parent 49355e1 commit e3ecec5

File tree

14 files changed

+41
-32
lines changed

14 files changed

+41
-32
lines changed

‎biojava-core/src/main/java/org/biojava/nbio/core/util/FileDownloadUtils.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -124,7 +124,7 @@ public static void downloadFile(URL url, File destination) throws IOException {
124124
int maxTries = 10;
125125
int timeout = 60000; //60 sec
126126

127-
File tempFile = File.createTempFile(getFilePrefix(destination), "." + getFileExtension(destination));
127+
File tempFile = Files.createTempFile(getFilePrefix(destination), "." + getFileExtension(destination)).toFile();
128128

129129
// Took following recipe from stackoverflow:
130130
// http://stackoverflow.com/questions/921262/how-to-download-and-save-a-file-from-internet-using-java
@@ -296,4 +296,4 @@ public static void deleteDirectory(String dir) throws IOException {
296296
deleteDirectory(Paths.get(dir));
297297
}
298298

299-
}
299+
}

‎biojava-core/src/test/java/org/biojava/nbio/core/util/FileDownloadUtilsTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ class FileCopy {
2222

2323
private File createSrcFile () throws IOException {
2424
byte [] toSave = new byte []{1,2,3,4,5};
25-
File src = File.createTempFile("test", ".dat");
25+
File src = Files.createTempFile("test", ".dat").toFile();
2626
try (FileOutputStream fos = new FileOutputStream(src);){
2727
fos.write(toSave);
2828
}
@@ -34,7 +34,7 @@ void copyFile() throws IOException {
3434
File src = createSrcFile();
3535
//sanity check
3636
assertEquals(5, src.length());
37-
File dest = File.createTempFile("dest", ".dat");
37+
File dest = Files.createTempFile("dest", ".dat").toFile();
3838
assertEquals(0, dest.length());
3939
FileDownloadUtils.copy(src, dest);
4040
assertEquals(5, dest.length());

‎biojava-core/src/test/java/org/biojava/nbio/core/util/FlatFileCacheTest.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,6 +9,7 @@
99
import java.io.IOException;
1010
import java.io.InputStream;
1111
import java.nio.charset.StandardCharsets;
12+
import java.nio.file.Files;
1213

1314
import org.junit.jupiter.api.BeforeEach;
1415
import org.junit.jupiter.api.Test;
@@ -24,7 +25,7 @@ void before(){
2425
}
2526

2627
File createSmallTmpFile() throws IOException{
27-
File f = File.createTempFile("flatFile","txt");
28+
File f = Files.createTempFile("flatFile", "txt").toFile();
2829
writeToFile( aDNA, f);
2930
return f;
3031
}

‎biojava-core/src/test/java/org/biojava/nbio/core/util/XMLHelperTest.java‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ Document readTestDoc() throws SAXException, IOException, ParserConfigurationExce
6767

6868
@Test
6969
void fileToDocument() throws IOException, SAXException, ParserConfigurationException {
70-
File tmpFile = File.createTempFile("xml", ".xml");
70+
File tmpFile = Files.createTempFile("xml", ".xml").toFile();
7171
Files.write(Paths.get(tmpFile.getAbsolutePath()), TEST_XML.getBytes());
7272
Document doc = XMLHelper.loadXML(tmpFile.getAbsolutePath());
7373
assertParsedDocument(doc);
@@ -190,4 +190,4 @@ Document createDocumentWithRootElement() throws ParserConfigurationException {
190190
doc.appendChild(root);
191191
return doc;
192192
}
193-
}
193+
}

‎biojava-genome/src/test/java/org/biojava/nbio/genome/GeneFeatureHelperTest.java‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -36,6 +36,7 @@
3636

3737
import java.io.File;
3838
import java.io.FileOutputStream;
39+
import java.nio.file.Files;
3940
import java.util.Collection;
4041
import java.util.LinkedHashMap;
4142

@@ -78,7 +79,7 @@ public void testLoadFastaAddGeneFeaturesFromUpperCaseExonFastaFile() throws Exce
7879
.loadFastaAddGeneFeaturesFromUpperCaseExonFastaFile(fastaSequenceFile, uppercaseFastaFile,
7980
throwExceptionGeneNotFound);
8081

81-
File tmp = File.createTempFile("volvox_all_genes_exon_uppercase", "gff3");
82+
File tmp = Files.createTempFile("volvox_all_genes_exon_uppercase","gff3").toFile();
8283
tmp.deleteOnExit();
8384
FileOutputStream fo = new FileOutputStream(tmp);
8485
GFF3Writer gff3Writer = new GFF3Writer();
@@ -95,7 +96,7 @@ public void testOutputFastaSequenceLengthGFF3() throws Exception {
9596
// logger.info("outputFastaSequenceLengthGFF3");
9697

9798
File fastaSequenceFile = new File("src/test/resources/volvox_all.fna");
98-
File gffFile = File.createTempFile("volvox_length", "gff3");
99+
File gffFile = Files.createTempFile("volvox_length","gff3").toFile();
99100
gffFile.deleteOnExit();
100101
GeneFeatureHelper.outputFastaSequenceLengthGFF3(fastaSequenceFile, gffFile);
101102
FileAssert.assertEquals("volvox_length.gff3 and volvox_length_output.gff3 are not equal", gffFile,
@@ -135,7 +136,7 @@ public void testGetProteinSequences() throws Exception {
135136
// for(ProteinSequence proteinSequence : proteinSequenceList.values()){
136137
// logger.info("Output={}", proteinSequence.getSequenceAsString());
137138
// }
138-
File tmp = File.createTempFile("volvox_all", "faa");
139+
File tmp = Files.createTempFile("volvox_all","faa").toFile();
139140
tmp.deleteOnExit();
140141
FastaWriterHelper.writeProteinSequence(tmp, proteinSequenceList.values());
141142
FileAssert.assertEquals("volvox_all_reference.faa and volvox_all.faa are not equal", new File(
@@ -155,7 +156,7 @@ public void testGetGeneSequences() throws Exception {
155156
.getGeneSequences(chromosomeSequenceList.values());
156157
Collection<GeneSequence> geneSequences = geneSequenceHashMap.values();
157158

158-
File tmp = File.createTempFile("volvox_all_genes_exon_uppercase", "fna");
159+
File tmp = Files.createTempFile("volvox_all_genes_exon_uppercase","fna").toFile();
159160
tmp.deleteOnExit();
160161
FastaWriterHelper.writeGeneSequence(tmp, geneSequences, true);
161162
}

‎biojava-genome/src/test/java/org/biojava/nbio/genome/io/fastq/AbstractFastqReaderTest.java‎

100755100644
Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -28,6 +28,7 @@
2828
import java.io.InputStream;
2929
import java.io.StringReader;
3030
import java.net.URL;
31+
import java.nio.file.Files;
3132

3233

3334
/**
@@ -132,7 +133,7 @@ public void testReadFile() throws Exception
132133
public void testReadEmptyFile() throws Exception
133134
{
134135
FastqReader reader = createFastqReader();
135-
File empty = File.createTempFile("abstractFastqReaderTest", null);
136+
File empty = Files.createTempFile("abstractFastqReaderTest",null).toFile();
136137
Iterable<Fastq> iterable = reader.read(empty);
137138
Assert.assertNotNull(iterable);
138139
int count = 0;
@@ -148,7 +149,7 @@ public void testReadEmptyFile() throws Exception
148149
public void testReadRoundTripSingleFile() throws Exception
149150
{
150151
FastqReader reader = createFastqReader();
151-
File single = File.createTempFile("abstractFastqReaderTest", null);
152+
File single = Files.createTempFile("abstractFastqReaderTest",null).toFile();
152153
Fastq fastq = createFastq();
153154
FastqWriter writer = createFastqWriter();
154155
writer.write(single, fastq);
@@ -167,7 +168,7 @@ public void testReadRoundTripSingleFile() throws Exception
167168
public void testReadRoundTripMultipleFile() throws Exception
168169
{
169170
FastqReader reader = createFastqReader();
170-
File multiple = File.createTempFile("abstractFastqReaderTest", null);
171+
File multiple = Files.createTempFile("abstractFastqReaderTest",null).toFile();
171172
Fastq fastq0 = createFastq();
172173
Fastq fastq1 = createFastq();
173174
Fastq fastq2 = createFastq();

‎biojava-genome/src/test/java/org/biojava/nbio/genome/io/fastq/AbstractFastqWriterTest.java‎

100755100644
Lines changed: 12 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@
2626
import java.io.ByteArrayOutputStream;
2727
import java.io.File;
2828
import java.io.OutputStream;
29+
import java.nio.file.Files;
2930
import java.util.ArrayList;
3031
import java.util.List;
3132

@@ -134,15 +135,15 @@ public void testWriteFileVararg() throws Exception
134135
Fastq fastq0 = createFastq();
135136
Fastq fastq1 = createFastq();
136137
Fastq fastq2 = createFastq();
137-
File file0 = File.createTempFile("abstractFastqWriterTest", null);
138+
File file0 = Files.createTempFile("abstractFastqWriterTest",null).toFile();
138139
writer.write(file0, fastq0);
139-
File file1 = File.createTempFile("abstractFastqWriterTest", null);
140+
File file1 = Files.createTempFile("abstractFastqWriterTest",null).toFile();
140141
writer.write(file1, fastq0, fastq1);
141-
File file2 = File.createTempFile("abstractFastqWriterTest", null);
142+
File file2 = Files.createTempFile("abstractFastqWriterTest",null).toFile();
142143
writer.write(file2, fastq0, fastq1, fastq2);
143-
File file3 = File.createTempFile("abstractFastqWriterTest", null);
144+
File file3 = Files.createTempFile("abstractFastqWriterTest",null).toFile();
144145
writer.write(file3, fastq0, fastq1, fastq2, null);
145-
File file4 = File.createTempFile("abstractFastqWriterTest", null);
146+
File file4 = Files.createTempFile("abstractFastqWriterTest",null).toFile();
146147
writer.write(file4, (Fastq) null);
147148

148149
try
@@ -164,26 +165,26 @@ public void testWriteFileIterable() throws Exception
164165
Fastq fastq1 = createFastq();
165166
Fastq fastq2 = createFastq();
166167
List<Fastq> list = new ArrayList<Fastq>();
167-
File file0 = File.createTempFile("abstractFastqWriterTest", null);
168+
File file0 = Files.createTempFile("abstractFastqWriterTest",null).toFile();
168169
writer.write(file0, list);
169170

170171
list.add(fastq0);
171-
File file1 = File.createTempFile("abstractFastqWriterTest", null);
172+
File file1 = Files.createTempFile("abstractFastqWriterTest",null).toFile();
172173
writer.write(file1, list);
173174

174175
list.add(fastq1);
175-
File file2 = File.createTempFile("abstractFastqWriterTest", null);
176+
File file2 = Files.createTempFile("abstractFastqWriterTest",null).toFile();
176177
writer.write(file2, list);
177178

178179
list.add(fastq2);
179-
File file3 = File.createTempFile("abstractFastqWriterTest", null);
180+
File file3 = Files.createTempFile("abstractFastqWriterTest",null).toFile();
180181
writer.write(file3, list);
181182

182183
list.add(null);
183-
File file4 = File.createTempFile("abstractFastqWriterTest", null);
184+
File file4 = Files.createTempFile("abstractFastqWriterTest",null).toFile();
184185
writer.write(file4, list);
185186

186-
File file5 = File.createTempFile("abstractFastqWriterTest", null);
187+
File file5 = Files.createTempFile("abstractFastqWriterTest",null).toFile();
187188

188189
try
189190
{

‎biojava-genome/src/test/java/org/biojava/nbio/genome/io/fastq/ConvertTest.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@
2222

2323
import java.io.File;
2424
import java.io.FileWriter;
25+
import java.nio.file.Files;
2526
import java.util.List;
2627
import java.util.Map;
2728

@@ -74,7 +75,7 @@ public void testConvert() throws Exception
7475
FastqWriter writer = writers.get(variant2);
7576
String expectedFileName = expectedFileNames.get(new FastqVariantPair(variant1, variant2));
7677

77-
File tmp = File.createTempFile("convertTest", "fastq");
78+
File tmp = Files.createTempFile("convertTest","fastq").toFile();
7879
FileWriter fileWriter = new FileWriter(tmp);
7980

8081
for (Fastq fastq : reader.read(getClass().getResource(inputFileName))) {

‎biojava-modfinder/src/main/java/org/biojava/nbio/phosphosite/Dataset.java‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ public void downloadFile(URL u, File localFile) throws IOException {
152152

153153
logger.info("Downloading " + u);
154154

155-
File tmp = File.createTempFile("tmp","phosphosite");
155+
File tmp = Files.createTempFile("tmp","phosphosite").toFile();
156156

157157
InputStream is = u.openStream();
158158

‎biojava-structure/src/main/java/org/biojava/nbio/structure/cath/CathInstallation.java‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,6 +31,7 @@
3131

3232
import java.io.*;
3333
import java.net.URL;
34+
import java.nio.file.Files;
3435
import java.text.DateFormat;
3536
import java.text.DecimalFormat;
3637
import java.text.ParseException;
@@ -639,7 +640,7 @@ protected void downloadFileFromRemote(URL remoteURL, File localFile) throws IOEx
639640
LOGGER.info("Downloading file {} to local file {}", remoteURL, localFile);
640641

641642
long timeS = System.currentTimeMillis();
642-
File tempFile = File.createTempFile(FileDownloadUtils.getFilePrefix(localFile), "."+ FileDownloadUtils.getFileExtension(localFile));
643+
File tempFile = Files.createTempFile(FileDownloadUtils.getFilePrefix(localFile),"." + FileDownloadUtils.getFileExtension(localFile)).toFile();
643644

644645
FileOutputStream out = new FileOutputStream(tempFile);
645646

0 commit comments

Comments
 (0)