This is an automated email from the ASF dual-hosted git repository.
rkhachatryan pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/flink.git
The following commit(s) were added to refs/heads/master by this push:
new e439490a9c5 [FLINK-37666] CWE-378: Creation of Temporary File With
Insecure Permissions in Temporary File Creation
e439490a9c5 is described below
commit e439490a9c565b142e17fe001ce2a6ca200148e3
Author: Samrat002 <[email protected]>
AuthorDate: Wed Aug 12 10:58:50 2026 +0530
[FLINK-37666] CWE-378: Creation of Temporary File With Insecure Permissions
in Temporary File Creation
---
.../java/org/apache/flink/client/program/PackagedProgram.java | 4 +++-
.../flink/changelog/fs/ChangelogStreamHandleReaderWithCache.java | 2 +-
.../flink/table/examples/java/basics/StreamWindowSQLExample.java | 3 ++-
.../main/java/org/apache/flink/yarn/YarnClusterDescriptor.java | 8 ++++++--
4 files changed, 12 insertions(+), 5 deletions(-)
diff --git
a/flink-clients/src/main/java/org/apache/flink/client/program/PackagedProgram.java
b/flink-clients/src/main/java/org/apache/flink/client/program/PackagedProgram.java
index 0479cb7a544..2fb1a95de9d 100644
---
a/flink-clients/src/main/java/org/apache/flink/client/program/PackagedProgram.java
+++
b/flink-clients/src/main/java/org/apache/flink/client/program/PackagedProgram.java
@@ -45,6 +45,7 @@ import java.net.MalformedURLException;
import java.net.URISyntaxException;
import java.net.URL;
import java.net.URLClassLoader;
+import java.nio.file.Files;
import java.util.ArrayList;
import java.util.Collections;
import java.util.List;
@@ -584,7 +585,8 @@ public class PackagedProgram implements AutoCloseable {
private static File createTempFile(Random rnd, JarEntry entry, String name)
throws ProgramInvocationException {
try {
- final File tempFile =
File.createTempFile(rnd.nextInt(Integer.MAX_VALUE) + "_", name);
+ final File tempFile =
+ Files.createTempFile(rnd.nextInt(Integer.MAX_VALUE) + "_",
name).toFile();
tempFile.deleteOnExit();
return tempFile;
} catch (IOException e) {
diff --git
a/flink-dstl/flink-dstl-dfs/src/main/java/org/apache/flink/changelog/fs/ChangelogStreamHandleReaderWithCache.java
b/flink-dstl/flink-dstl-dfs/src/main/java/org/apache/flink/changelog/fs/ChangelogStreamHandleReaderWithCache.java
index 70f2f66ef35..e5f1d98f717 100644
---
a/flink-dstl/flink-dstl-dfs/src/main/java/org/apache/flink/changelog/fs/ChangelogStreamHandleReaderWithCache.java
+++
b/flink-dstl/flink-dstl-dfs/src/main/java/org/apache/flink/changelog/fs/ChangelogStreamHandleReaderWithCache.java
@@ -128,7 +128,7 @@ class ChangelogStreamHandleReaderWithCache implements
ChangelogStreamHandleReade
File directory = cacheDirectories[next.getAndIncrement() %
cacheDirectories.length];
File file;
try {
- file = File.createTempFile(CACHE_FILE_PREFIX, null, directory);
+ file = Files.createTempFile(directory.toPath(), CACHE_FILE_PREFIX,
null).toFile();
} catch (IOException e) {
ExceptionUtils.rethrow(e);
return null;
diff --git
a/flink-examples/flink-examples-table/src/main/java/org/apache/flink/table/examples/java/basics/StreamWindowSQLExample.java
b/flink-examples/flink-examples-table/src/main/java/org/apache/flink/table/examples/java/basics/StreamWindowSQLExample.java
index eb3f33de73f..7c20731bbb1 100644
---
a/flink-examples/flink-examples-table/src/main/java/org/apache/flink/table/examples/java/basics/StreamWindowSQLExample.java
+++
b/flink-examples/flink-examples-table/src/main/java/org/apache/flink/table/examples/java/basics/StreamWindowSQLExample.java
@@ -24,6 +24,7 @@ import org.apache.flink.util.FileUtils;
import java.io.File;
import java.io.IOException;
+import java.nio.file.Files;
/**
* Simple example for demonstrating the use of SQL in Java.
@@ -91,7 +92,7 @@ public class StreamWindowSQLExample {
/** Creates a temporary file with the contents and returns the absolute
path. */
private static String createTempFile(String contents) throws IOException {
- File tempFile = File.createTempFile("orders", ".csv");
+ File tempFile = Files.createTempFile("orders", ".csv").toFile();
tempFile.deleteOnExit();
FileUtils.writeFileUtf8(tempFile, contents);
return tempFile.toURI().toString();
diff --git
a/flink-yarn/src/main/java/org/apache/flink/yarn/YarnClusterDescriptor.java
b/flink-yarn/src/main/java/org/apache/flink/yarn/YarnClusterDescriptor.java
index 3736c6d8f3c..ad169a6f52c 100644
--- a/flink-yarn/src/main/java/org/apache/flink/yarn/YarnClusterDescriptor.java
+++ b/flink-yarn/src/main/java/org/apache/flink/yarn/YarnClusterDescriptor.java
@@ -119,6 +119,7 @@ import java.net.URI;
import java.net.URLDecoder;
import java.nio.ByteBuffer;
import java.nio.charset.Charset;
+import java.nio.file.Files;
import java.util.Arrays;
import java.util.Collection;
import java.util.Collections;
@@ -1032,7 +1033,8 @@ public class YarnClusterDescriptor implements
ClusterDescriptor<ApplicationId> {
if (jobGraph != null) {
File tmpJobGraphFile = null;
try {
- tmpJobGraphFile = File.createTempFile(appId.toString(), null);
+ tmpJobGraphFile = Files.createTempFile(appId.toString(),
null).toFile();
+ tmpJobGraphFile.deleteOnExit();
try (FileOutputStream output = new
FileOutputStream(tmpJobGraphFile);
ObjectOutputStream obOutput = new
ObjectOutputStream(output)) {
obOutput.writeObject(jobGraph);
@@ -1064,7 +1066,9 @@ public class YarnClusterDescriptor implements
ClusterDescriptor<ApplicationId> {
File tmpConfigurationFile = null;
try {
String flinkConfigFileName =
GlobalConfiguration.getFlinkConfFilename();
- tmpConfigurationFile = File.createTempFile(appId + "-" +
flinkConfigFileName, null);
+ tmpConfigurationFile =
+ Files.createTempFile(appId + "-" + flinkConfigFileName,
null).toFile();
+ tmpConfigurationFile.deleteOnExit();
// remove localhost bind hosts as they render production clusters
unusable
removeLocalhostBindHostSetting(configuration,
JobManagerOptions.BIND_HOST);
