Skip to content

Commit 107bbe0

Browse files
vuln-fix: Temporary Directory Hijacking or Information Disclosure
This fixes either Temporary Directory Hijacking, or Temporary Directory Local Information Disclosure. Weakness: CWE-379: Creation of Temporary File in Directory with Insecure Permissions Severity: High CVSSS: 7.3 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.UseFilesCreateTempDirectory) Reported-by: Jonathan Leitschuh <[email protected]> Signed-off-by: Jonathan Leitschuh <[email protected]> Bug-tracker: JLLeitschuh/security-research#10 Co-authored-by: Moderne <[email protected]>
1 parent 27151dd commit 107bbe0

1 file changed

Lines changed: 2 additions & 3 deletions

File tree

src/test/java/jmh/benchmark/FolderForBenchmark.java

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@
44

55
import java.io.File;
66
import java.io.IOException;
7+
import java.nio.file.Files;
78

89
/**
910
* Similar to a TemporaryFolder JUnit Rule, it provides a local git repository for the lifetime of a benchmark test.
@@ -111,9 +112,7 @@ public File newFolder() throws IOException {
111112
}
112113

113114
private File createTemporaryFolderIn(File parentFolder) throws IOException {
114-
File createdFolder = File.createTempFile("junit", "", parentFolder);
115-
createdFolder.delete();
116-
createdFolder.mkdir();
115+
File createdFolder = Files.createTempDirectory(parentFolder.toPath(), "junit").toFile();
117116
return createdFolder;
118117
}
119118

0 commit comments

Comments
 (0)