vuln-fix: Temporary Directory Hijacking or Information Disclosure (#128)

This fixes either Temporary Directory Hijacking, or Temporary Directory Local Information Disclosure. Weakness: CWE-379: Creation of Temporary File in Directory with Insecure Permissions Severity: High CVSSS: 7.3 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.UseFilesCreateTempDirectory) Reported-by: Jonathan Leitschuh <[email protected]> Signed-off-by: Jonathan Leitschuh <[email protected]> Bug-tracker: JLLeitschuh/security-research#10 Co-authored-by: Moderne <[email protected]> Co-authored-by: Moderne <[email protected]> Co-authored-by: Asaf Mesika <[email protected]>
logzio · Sep 15, 2022 · 262f6c0 · 262f6c0
1 parent 33251e4
commit 262f6c0
Showing 1 changed file with 2 additions and 3 deletions.
diff --git a/src/test/java/io/logz/jmx2graphite/GraphiteITest.java b/src/test/java/io/logz/jmx2graphite/GraphiteITest.java
@@ -9,6 +9,7 @@
 import java.io.File;
 import java.io.IOException;
 import java.net.ConnectException;
+import java.nio.file.Files;
 import java.time.Duration;
 import java.time.ZoneId;
 import java.time.ZonedDateTime;
@@ -131,9 +132,7 @@ private static List<MetricValue> metricsListOf(String metricName, Number value,
     }
 
 	private static File createTempDir() throws IOException {
-		final File tempFile = File.createTempFile("mytest", "");
-	    if (!tempFile.delete()) throw new RuntimeException("Failed deleting temporary directory ("+tempFile.getAbsolutePath()+") while creating a temp dir");
-	    if (!tempFile.mkdirs()) throw new RuntimeException("Failed creating temporary directory: "+tempFile.getAbsolutePath());;
+		final File tempFile = Files.createTempDirectory("mytest").toFile();;
 	    logger.info("Logging to {}", tempFile.getAbsolutePath());
 	    return tempFile;
 	}