This is an automated email from the ASF dual-hosted git repository.
gnodet pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/camel.git
The following commit(s) were added to refs/heads/main by this push:
new 94e24109fbfc Fix SonarCloud S5443: replace publicly writable temp
directory usage (#25066)
94e24109fbfc is described below
commit 94e24109fbfc8ec4a64429968c7fb6193d678c51
Author: Guillaume Nodet <[email protected]>
AuthorDate: Mon Jul 27 09:05:43 2026 +0200
Fix SonarCloud S5443: replace publicly writable temp directory usage
(#25066)
Fix 6 SonarCloud CRITICAL S5443 vulnerabilities across
camel-jbang-plugin-tui
(5 issues) and camel-console (1 issue). Replace direct
Files.createTempFile()
calls in publicly writable directories with secure alternatives using
Files.createTempDirectory() to create owner-only subdirectories first.
Co-authored-by: Claude Opus 4.6 <[email protected]>
---
.../impl/console/JfrMemoryLeakDevConsole.java | 11 +++++++++-
.../core/commands/tui/ExampleBrowserPopup.java | 3 +--
.../jbang/core/commands/tui/FolderInputPopup.java | 2 +-
.../jbang/core/commands/tui/InfraBrowserPopup.java | 3 +--
.../dsl/jbang/core/commands/tui/LaunchManager.java | 25 ++++++++++++++++++++--
5 files changed, 36 insertions(+), 8 deletions(-)
diff --git
a/core/camel-console/src/main/java/org/apache/camel/impl/console/JfrMemoryLeakDevConsole.java
b/core/camel-console/src/main/java/org/apache/camel/impl/console/JfrMemoryLeakDevConsole.java
index bc7ac400ef58..705b375790de 100644
---
a/core/camel-console/src/main/java/org/apache/camel/impl/console/JfrMemoryLeakDevConsole.java
+++
b/core/camel-console/src/main/java/org/apache/camel/impl/console/JfrMemoryLeakDevConsole.java
@@ -215,9 +215,11 @@ public class JfrMemoryLeakDevConsole extends
AbstractDevConsole {
return cachedResults != null ? cachedResults : errorJson("No
active recording.");
}
+ Path tempDir = null;
Path tempFile = null;
try {
- tempFile = Files.createTempFile("camel-jfr-memory-leak-", ".jfr");
+ tempDir = Files.createTempDirectory("camel-jfr-");
+ tempFile = Files.createTempFile(tempDir, "camel-jfr-memory-leak-",
".jfr");
// trigger GC before stopping to flush objects into the recording
System.gc();
try {
@@ -259,6 +261,13 @@ public class JfrMemoryLeakDevConsole extends
AbstractDevConsole {
// ignore
}
}
+ if (tempDir != null) {
+ try {
+ Files.deleteIfExists(tempDir);
+ } catch (IOException e) {
+ // ignore
+ }
+ }
}
}
diff --git
a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/ExampleBrowserPopup.java
b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/ExampleBrowserPopup.java
index 6d8f0aac87e2..54b8addc6f4d 100644
---
a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/ExampleBrowserPopup.java
+++
b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/ExampleBrowserPopup.java
@@ -16,7 +16,6 @@
*/
package org.apache.camel.dsl.jbang.core.commands.tui;
-import java.nio.file.Files;
import java.nio.file.Path;
import java.util.ArrayList;
import java.util.LinkedHashMap;
@@ -264,7 +263,7 @@ class ExampleBrowserPopup {
if (exampleName.contains("/") && extraArgs.stream().noneMatch(a ->
a.startsWith("--name"))) {
cmd.add("--name=" + TuiHelper.stripCategory(exampleName));
}
- Path outputFile = Files.createTempFile("camel-example-", ".log");
+ Path outputFile =
LaunchManager.createSecureTempFile("camel-example-", ".log");
outputFile.toFile().deleteOnExit();
ProcessBuilder pb = new ProcessBuilder(cmd);
pb.redirectErrorStream(true);
diff --git
a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/FolderInputPopup.java
b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/FolderInputPopup.java
index a0f04643c371..28573981d15f 100644
---
a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/FolderInputPopup.java
+++
b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/FolderInputPopup.java
@@ -345,7 +345,7 @@ class FolderInputPopup {
}
cmd.add("--logging-color=true");
cmd.addAll(extraArgs);
- Path outputFile = Files.createTempFile("camel-folder-", ".log");
+ Path outputFile =
LaunchManager.createSecureTempFile("camel-folder-", ".log");
outputFile.toFile().deleteOnExit();
ProcessBuilder pb = new ProcessBuilder(cmd);
pb.redirectErrorStream(true);
diff --git
a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/InfraBrowserPopup.java
b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/InfraBrowserPopup.java
index 9f9d14405fbd..72a5c8c30be9 100644
---
a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/InfraBrowserPopup.java
+++
b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/InfraBrowserPopup.java
@@ -18,7 +18,6 @@ package org.apache.camel.dsl.jbang.core.commands.tui;
import java.io.InputStream;
import java.nio.charset.StandardCharsets;
-import java.nio.file.Files;
import java.nio.file.Path;
import java.util.ArrayList;
import java.util.LinkedHashMap;
@@ -520,7 +519,7 @@ class InfraBrowserPopup {
if (!portStr.isEmpty()) {
cmd.add("--port=" + portStr);
}
- Path outputFile = Files.createTempFile("camel-infra-", ".log");
+ Path outputFile =
LaunchManager.createSecureTempFile("camel-infra-", ".log");
outputFile.toFile().deleteOnExit();
ProcessBuilder pb = new ProcessBuilder(cmd);
pb.redirectErrorStream(true);
diff --git
a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/LaunchManager.java
b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/LaunchManager.java
index 178ac6d46265..5c4c8d556257 100644
---
a/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/LaunchManager.java
+++
b/dsl/camel-jbang/camel-jbang-plugin-tui/src/main/java/org/apache/camel/dsl/jbang/core/commands/tui/LaunchManager.java
@@ -35,6 +35,8 @@ import org.apache.camel.util.json.JsonObject;
class LaunchManager {
+ private static volatile Path secureTempDir;
+
private final Supplier<List<InfraInfo>> infraServices;
private final List<PendingLaunch> pendingLaunches = new ArrayList<>();
private DeferredLaunch deferredLaunch;
@@ -75,7 +77,7 @@ class LaunchManager {
void launchDetached(String displayName, List<String> extraArgs) throws
IOException {
List<String> cmd = new ArrayList<>(LauncherHelper.getCamelCommand());
cmd.addAll(extraArgs);
- Path outputFile = Files.createTempFile("camel-launch-", ".log");
+ Path outputFile = createSecureTempFile("camel-launch-", ".log");
outputFile.toFile().deleteOnExit();
ProcessBuilder pb = new ProcessBuilder(cmd);
pb.redirectErrorStream(true);
@@ -129,7 +131,7 @@ class LaunchManager {
cmd.add("run");
cmd.add(alias);
cmd.add("--background");
- Path outputFile = Files.createTempFile("camel-infra-", ".log");
+ Path outputFile = createSecureTempFile("camel-infra-", ".log");
outputFile.toFile().deleteOnExit();
ProcessBuilder pb = new ProcessBuilder(cmd);
pb.redirectErrorStream(true);
@@ -149,6 +151,25 @@ class LaunchManager {
notify("Starting infra: " + infraList + " → then: " + displayName,
false);
}
+ /**
+ * Creates a temporary file inside a secure (owner-only permissions)
subdirectory rather than directly in the
+ * publicly writable system temp directory. This avoids SonarCloud S5443
(use of publicly writable directories).
+ */
+ static Path createSecureTempFile(String prefix, String suffix) throws
IOException {
+ Path dir = secureTempDir;
+ if (dir == null || !Files.isDirectory(dir)) {
+ synchronized (LaunchManager.class) {
+ dir = secureTempDir;
+ if (dir == null || !Files.isDirectory(dir)) {
+ dir = Files.createTempDirectory("camel-tui-");
+ dir.toFile().deleteOnExit();
+ secureTempDir = dir;
+ }
+ }
+ }
+ return Files.createTempFile(dir, prefix, suffix);
+ }
+
static boolean isContainerRuntimeAvailable() {
for (String cmd : new String[] { "docker", "podman" }) {
try {
