[fluo] branch main updated: vuln-fix: Temporary File Information Disclosure (#1125)

[kturner]

This is an automated email from the ASF dual-hosted git repository.

kturner pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/fluo.git


The following commit(s) were added to refs/heads/main by this push:
     new ce364a5b vuln-fix: Temporary File Information Disclosure (#1125)
ce364a5b is described below

commit ce364a5bea3d3d4f3883341ed1977b1724444e88
Author: Jonathan Leitschuh <jonathan.leitsc...@gmail.com>
AuthorDate: Sat Nov 19 06:14:05 2022 -0800

    vuln-fix: Temporary File Information Disclosure (#1125)
    
    This fixes temporary file information disclosure vulnerability due to the 
use
    of the vulnerable `File.createTempFile()` method. The vulnerability is 
fixed by
    using the `Files.createTempFile()` method which sets the correct posix 
permissions.
    
    Weakness: CWE-377: Insecure Temporary File
    Severity: Medium
    CVSSS: 5.5
    Detection: CodeQL & OpenRewrite 
(https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)
    
    Reported-by: Jonathan Leitschuh <jonathan.leitsc...@gmail.com>
    Signed-off-by: Jonathan Leitschuh <jonathan.leitsc...@gmail.com>
    
    Bug-tracker: https://github.com/JLLeitschuh/security-research/issues/18
    
    
    Co-authored-by: Moderne <t...@moderne.io>
---
 .../main/java/org/apache/fluo/integration/impl/StochasticBankIT.java   | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git 
a/modules/integration-tests/src/main/java/org/apache/fluo/integration/impl/StochasticBankIT.java
 
b/modules/integration-tests/src/main/java/org/apache/fluo/integration/impl/StochasticBankIT.java
index 192ca014..d9c779dc 100644
--- 
a/modules/integration-tests/src/main/java/org/apache/fluo/integration/impl/StochasticBankIT.java
+++ 
b/modules/integration-tests/src/main/java/org/apache/fluo/integration/impl/StochasticBankIT.java
@@ -19,6 +19,7 @@ import java.io.BufferedWriter;
 import java.io.File;
 import java.io.FileWriter;
 import java.io.Writer;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.HashMap;
 import java.util.List;
@@ -252,7 +253,7 @@ public class StochasticBankIT extends ITBaseImpl {
     log.debug("start times : " + lastTx.getStartTs() + " " + tx.getStartTs());
     log.debug("sum1 : %,d  sum2 : %,d  diff : %,d\n", sum1, sum2, sum2 - sum1);
 
-    File tmpFile = File.createTempFile("sb_dump", ".txt");
+    File tmpFile = Files.createTempFile("sb_dump", ".txt").toFile();
     Writer fw = new BufferedWriter(new FileWriter(tmpFile));
 
     Scanner scanner =