From 0d3b2048ac3aff17432397d67e625cb16abb04a3 Mon Sep 17 00:00:00 2001 From: Jonathan Leitschuh Date: Wed, 27 Jul 2022 16:36:32 +0000 Subject: [PATCH] vuln-fix: Temporary Directory Hijacking or Information Disclosure This fixes either Temporary Directory Hijacking, or Temporary Directory Local Information Disclosure. Weakness: CWE-379: Creation of Temporary File in Directory with Insecure Permissions Severity: High CVSSS: 7.3 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.UseFilesCreateTempDirectory) Reported-by: Jonathan Leitschuh Signed-off-by: Jonathan Leitschuh Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/10 Co-authored-by: Moderne --- src/main/java/doc/UnZip.java | 13 ++----------- src/main/java/doc_gui/NotebookPanel.java | 13 ++----------- 2 files changed, 4 insertions(+), 22 deletions(-) diff --git a/src/main/java/doc/UnZip.java b/src/main/java/doc/UnZip.java index d1247d3..6a32912 100644 --- a/src/main/java/doc/UnZip.java +++ b/src/main/java/doc/UnZip.java @@ -8,6 +8,7 @@ import javax.swing.*; import java.io.*; +import java.nio.file.Files; import java.util.ArrayList; import java.util.Enumeration; import java.util.List; @@ -23,17 +24,7 @@ public static File createTempDirectory() throws IOException { final File temp; - temp = File.createTempFile("temp", Long.toString(System.nanoTime())); - - if(!(temp.delete())) - { - throw new IOException("Could not delete temp file: " + temp.getAbsolutePath()); - } - - if(!(temp.mkdir())) - { - throw new IOException("Could not create temp directory: " + temp.getAbsolutePath()); - } + temp = Files.createTempDirectory("temp" + Long.toString(System.nanoTime())).toFile(); return (temp); } diff --git a/src/main/java/doc_gui/NotebookPanel.java b/src/main/java/doc_gui/NotebookPanel.java index fa8aaf2..72ae244 100644 --- a/src/main/java/doc_gui/NotebookPanel.java +++ b/src/main/java/doc_gui/NotebookPanel.java @@ -29,6 +29,7 @@ import java.net.HttpURLConnection; import java.net.URL; import java.net.URLEncoder; +import java.nio.file.Files; import java.util.Vector; import java.util.regex.Matcher; import java.util.regex.Pattern; @@ -878,17 +879,7 @@ public void save() { public static File createTempDirectory() throws IOException{ final File temp; - temp = File.createTempFile("temp", Long.toString(System.nanoTime())); - - if(!(temp.delete())) - { - throw new IOException("Could not delete temp file: " + temp.getAbsolutePath()); - } - - if(!(temp.mkdir())) - { - throw new IOException("Could not create temp directory: " + temp.getAbsolutePath()); - } + temp = Files.createTempDirectory("temp" + Long.toString(System.nanoTime())).toFile(); return (temp); }