vuln-fix: Temporary Directory Hijacking or Information Disclosure

This fixes either Temporary Directory Hijacking, or Temporary Directory Local Information Disclosure.

Weakness: CWE-379: Creation of Temporary File in Directory with Insecure Permissions
Severity: High
CVSSS: 7.3
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.UseFilesCreateTempDirectory)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: JLLeitschuh/security-research#10


Co-authored-by: Moderne <team@moderne.io>

src/test/java/org/codehaus/plexus/archiver/tar/TarArchiverTest.java

@@ -49,6 +49,7 @@
 import java.io.FileInputStream;
 import java.io.FileWriter;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Enumeration;
 import java.util.LinkedHashMap;
 import java.util.Map;
@@ -99,10 +100,7 @@ public void testCreateArchiveWithDetectedModes()
         File tmpDir = null;
         try
         {
-            tmpDir = File.createTempFile( "tbz2-with-chmod.", ".dir" );
-            tmpDir.delete();
-
-            tmpDir.mkdirs();
+            tmpDir = Files.createTempDirectory("tbz2-with-chmod." + ".dir").toFile();
 
             for ( String executablePath : executablePaths )
             {

src/test/java/org/codehaus/plexus/archiver/tar/TarFileAttributesTest.java

@@ -3,6 +3,7 @@
 import java.io.File;
 import java.io.FileWriter;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.List;
 
@@ -125,9 +126,7 @@ public void testUseAttributesFromTarArchiveInputInTarArchiverOutput()
         // Cut from here, and feed it into a new tar archiver...then unarchive THAT.
         TarUnArchiver tarUnArchiver = (TarUnArchiver) lookup( UnArchiver.ROLE, "tar" );
 
-        File tempTarDir = File.createTempFile( "tar-test.", ".dir" );
-        tempTarDir.delete();
-        tempTarDir.mkdirs();
+        File tempTarDir = Files.createTempDirectory("tar-test." + ".dir").toFile();
 
         toDelete.add( tempTarDir );
 
@@ -189,9 +188,7 @@ public void testUseDetectedFileAttributes()
 
         TarUnArchiver tarUnArchiver = (TarUnArchiver) lookup( UnArchiver.ROLE, "tar" );
 
-        File tempTarDir = File.createTempFile( "tar-test.", ".dir" );
-        tempTarDir.delete();
-        tempTarDir.mkdirs();
+        File tempTarDir = Files.createTempDirectory("tar-test." + ".dir").toFile();
 
         toDelete.add( tempTarDir );
 
@@ -253,9 +250,7 @@ public void testOverrideDetectedFileAttributes()
 
         TarUnArchiver tarUnArchiver = (TarUnArchiver) lookup( UnArchiver.ROLE, "tar" );
 
-        File tempTarDir = File.createTempFile( "tar-test.", ".dir" );
-        tempTarDir.delete();
-        tempTarDir.mkdirs();
+        File tempTarDir = Files.createTempDirectory("tar-test." + ".dir").toFile();
 
         toDelete.add( tempTarDir );
 
@@ -319,9 +314,7 @@ public void testOverrideDetectedFileAttributesUsingFileMode()
 
         TarUnArchiver tarUnArchiver = (TarUnArchiver) lookup( UnArchiver.ROLE, "tar" );
 
-        File tempTarDir = File.createTempFile( "tar-test.", ".dir" );
-        tempTarDir.delete();
-        tempTarDir.mkdirs();
+        File tempTarDir = Files.createTempDirectory("tar-test." + ".dir").toFile();
 
         toDelete.add( tempTarDir );
 

src/test/java/org/codehaus/plexus/archiver/zip/ZipArchiverTest.java

@@ -57,6 +57,7 @@
 import java.io.FileWriter;
 import java.io.IOException;
 import java.io.InputStream;
+import java.nio.file.Files;
 import java.util.Arrays;
 import java.util.Date;
 import java.util.Enumeration;
@@ -160,10 +161,7 @@ public void testCreateArchiveWithDetectedModes()
         File tmpDir = null;
         try
         {
-            tmpDir = File.createTempFile( "zip-with-chmod.", ".dir" );
-            tmpDir.delete();
-
-            tmpDir.mkdirs();
+            tmpDir = Files.createTempDirectory("zip-with-chmod." + ".dir").toFile();
 
             for ( String executablePath : executablePaths )
             {