[maven-artifact-transfer] branch master updated: vuln-fix: Temporary File Information Disclosure

[slachiewicz]

This is an automated email from the ASF dual-hosted git repository.

slachiewicz pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/maven-artifact-transfer.git


The following commit(s) were added to refs/heads/master by this push:
     new a4e008e  vuln-fix: Temporary File Information Disclosure
a4e008e is described below

commit a4e008e9700be30c19914e04780fdbf10b35a65f
Author: Jonathan Leitschuh <jonathan.leitsc...@gmail.com>
AuthorDate: Fri Nov 18 22:42:36 2022 +0000

    vuln-fix: Temporary File Information Disclosure
    
    
    
    This fixes temporary file information disclosure vulnerability due to the 
use
    of the vulnerable `File.createTempFile()` method. The vulnerability is 
fixed by
    using the `Files.createTempFile()` method which sets the correct posix 
permissions.
    
    Weakness: CWE-377: Insecure Temporary File
    Severity: Medium
    CVSSS: 5.5
    Detection: CodeQL & OpenRewrite 
(https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)
    
    Reported-by: Jonathan Leitschuh <jonathan.leitsc...@gmail.com>
    Signed-off-by: Jonathan Leitschuh <jonathan.leitsc...@gmail.com>
    
    Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18
    
    
    Co-authored-by: Moderne <t...@moderne.io>
---
 .../artifact/install/internal/Maven30ArtifactInstallerTest.java        | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git 
a/maven-3.0.x/src/test/java/org/apache/maven/shared/transfer/artifact/install/internal/Maven30ArtifactInstallerTest.java
 
b/maven-3.0.x/src/test/java/org/apache/maven/shared/transfer/artifact/install/internal/Maven30ArtifactInstallerTest.java
index 61ef91f..4f72a78 100644
--- 
a/maven-3.0.x/src/test/java/org/apache/maven/shared/transfer/artifact/install/internal/Maven30ArtifactInstallerTest.java
+++ 
b/maven-3.0.x/src/test/java/org/apache/maven/shared/transfer/artifact/install/internal/Maven30ArtifactInstallerTest.java
@@ -20,6 +20,7 @@ package 
org.apache.maven.shared.transfer.artifact.install.internal;
  */
 
 import java.io.File;
+import java.nio.file.Files;
 import java.util.Arrays;
 import java.util.Collection;
 
@@ -61,7 +62,7 @@ public class Maven30ArtifactInstallerTest extends 
PlexusTestCase
 
         File artifactsDirectory = new File( "target/tests/artifacts" );
         artifactsDirectory.mkdirs();
-        File tmpFile = File.createTempFile( "test-install", ".jar", 
artifactsDirectory );
+        File tmpFile = Files.createTempFile( artifactsDirectory.toPath(), 
"test-install", ".jar" ).toFile();
         
         DefaultArtifact artifact = new DefaultArtifact( "GROUPID", 
"ARTIFACTID", "VERSION", "compile", "jar", null, artifactHandler );
         artifact.setFile( tmpFile );