This is an automated email from the ASF dual-hosted git repository. gnodet pushed a commit to branch fix-sonarcloud-critical-vulnerabilities-6x-s5443 in repository https://gitbox.apache.org/repos/asf/camel.git
commit 90338648f216aca60f133f24c4ced50595298b11 Author: Guillaume Nodet <[email protected]> AuthorDate: Thu Jul 23 16:54:12 2026 +0200 chore(sonarcloud): fix S5443 publicly writable directory usage in camel-jbang-plugin-tui Replace direct Files.createTempFile() calls (which create files in the publicly writable system temp directory) with a secure alternative that first creates a subdirectory with owner-only permissions via Files.createTempDirectory(), then creates temp files inside it. Adds LaunchManager.createSecureTempFile() utility used by ExampleBrowserPopup, FolderInputPopup, InfraBrowserPopup, and LaunchManager itself. Co-Authored-By: Claude Opus 4.6 <[email protected]> --- .../core/commands/tui/ExampleBrowserPopup.java | 3 +-- .../jbang/core/commands/tui/FolderInputPopup.java | 2 +- .../jbang/core/commands/tui/InfraBrowserPopup.java | 3 +-- .../dsl/jbang/core/commands/tui/LaunchManager.java | 25 ++++++++++++++++++++-- 4 files changed, 26 insertions(+), 7 deletions(-) diff --git a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/ExampleBrowserPopup.java b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/ExampleBrowserPopup.java index 6d8f0aac87e2..54b8addc6f4d 100644 --- a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/ExampleBrowserPopup.java +++ b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/ExampleBrowserPopup.java @@ -16,7 +16,6 @@ */ package org.apache.camel.dsl.jbang.core.commands.tui; -import java.nio.file.Files; import java.nio.file.Path; import java.util.ArrayList; import java.util.LinkedHashMap; @@ -264,7 +263,7 @@ class ExampleBrowserPopup { if (exampleName.contains("/") && extraArgs.stream().noneMatch(a -> a.startsWith("--name"))) { cmd.add("--name=" + TuiHelper.stripCategory(exampleName)); } - Path outputFile = Files.createTempFile("camel-example-", ".log"); + Path outputFile = LaunchManager.createSecureTempFile("camel-example-", ".log"); outputFile.toFile().deleteOnExit(); ProcessBuilder pb = new ProcessBuilder(cmd); pb.redirectErrorStream(true); diff --git a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/FolderInputPopup.java b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/FolderInputPopup.java index a0f04643c371..28573981d15f 100644 --- a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/FolderInputPopup.java +++ b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/FolderInputPopup.java @@ -345,7 +345,7 @@ class FolderInputPopup { } cmd.add("--logging-color=true"); cmd.addAll(extraArgs); - Path outputFile = Files.createTempFile("camel-folder-", ".log"); + Path outputFile = LaunchManager.createSecureTempFile("camel-folder-", ".log"); outputFile.toFile().deleteOnExit(); ProcessBuilder pb = new ProcessBuilder(cmd); pb.redirectErrorStream(true); diff --git a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/InfraBrowserPopup.java b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/InfraBrowserPopup.java index 9f9d14405fbd..72a5c8c30be9 100644 --- a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/InfraBrowserPopup.java +++ b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/InfraBrowserPopup.java @@ -18,7 +18,6 @@ package org.apache.camel.dsl.jbang.core.commands.tui; import java.io.InputStream; import java.nio.charset.StandardCharsets; -import java.nio.file.Files; import java.nio.file.Path; import java.util.ArrayList; import java.util.LinkedHashMap; @@ -520,7 +519,7 @@ class InfraBrowserPopup { if (!portStr.isEmpty()) { cmd.add("--port=" + portStr); } - Path outputFile = Files.createTempFile("camel-infra-", ".log"); + Path outputFile = LaunchManager.createSecureTempFile("camel-infra-", ".log"); outputFile.toFile().deleteOnExit(); ProcessBuilder pb = new ProcessBuilder(cmd); pb.redirectErrorStream(true); diff --git a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/LaunchManager.java b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/LaunchManager.java index 178ac6d46265..5c4c8d556257 100644 --- a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/LaunchManager.java +++ b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/LaunchManager.java @@ -35,6 +35,8 @@ import org.apache.camel.util.json.JsonObject; class LaunchManager { + private static volatile Path secureTempDir; + private final Supplier<List<InfraInfo>> infraServices; private final List<PendingLaunch> pendingLaunches = new ArrayList<>(); private DeferredLaunch deferredLaunch; @@ -75,7 +77,7 @@ class LaunchManager { void launchDetached(String displayName, List<String> extraArgs) throws IOException { List<String> cmd = new ArrayList<>(LauncherHelper.getCamelCommand()); cmd.addAll(extraArgs); - Path outputFile = Files.createTempFile("camel-launch-", ".log"); + Path outputFile = createSecureTempFile("camel-launch-", ".log"); outputFile.toFile().deleteOnExit(); ProcessBuilder pb = new ProcessBuilder(cmd); pb.redirectErrorStream(true); @@ -129,7 +131,7 @@ class LaunchManager { cmd.add("run"); cmd.add(alias); cmd.add("--background"); - Path outputFile = Files.createTempFile("camel-infra-", ".log"); + Path outputFile = createSecureTempFile("camel-infra-", ".log"); outputFile.toFile().deleteOnExit(); ProcessBuilder pb = new ProcessBuilder(cmd); pb.redirectErrorStream(true); @@ -149,6 +151,25 @@ class LaunchManager { notify("Starting infra: " + infraList + " → then: " + displayName, false); } + /** + * Creates a temporary file inside a secure (owner-only permissions) subdirectory rather than directly in the + * publicly writable system temp directory. This avoids SonarCloud S5443 (use of publicly writable directories). + */ + static Path createSecureTempFile(String prefix, String suffix) throws IOException { + Path dir = secureTempDir; + if (dir == null || !Files.isDirectory(dir)) { + synchronized (LaunchManager.class) { + dir = secureTempDir; + if (dir == null || !Files.isDirectory(dir)) { + dir = Files.createTempDirectory("camel-tui-"); + dir.toFile().deleteOnExit(); + secureTempDir = dir; + } + } + } + return Files.createTempFile(dir, prefix, suffix); + } + static boolean isContainerRuntimeAvailable() { for (String cmd : new String[] { "docker", "podman" }) { try {
