Thanks to visit codestin.com
Credit goes to github.com

Skip to content

Commit 9299c79

Browse files
JLLeitschuhJLLeitschuh
committed
Add information disclosure test fix suggestions
1 parent 0a621c2 commit 9299c79

1 file changed

Lines changed: 176 additions & 17 deletions

File tree

  • java/ql/test/query-tests/security/CWE-200/semmle/tests

‎java/ql/test/query-tests/security/CWE-200/semmle/tests/Test.java‎

Lines changed: 176 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,8 @@
33
import java.io.File;
44
import java.io.IOException;
55
import java.nio.file.Files;
6+
import java.nio.file.Path;
7+
import java.nio.file.Paths;
68
import java.nio.charset.StandardCharsets;
79
import java.nio.file.StandardOpenOption;
810
import java.nio.file.attribute.PosixFilePermission;
@@ -12,96 +14,253 @@
1214
public class Test {
1315

1416
void vulnerableFileCreateTempFile() throws IOException {
15-
File temp = File.createTempFile("random", "file");
17+
// VULNERABLE VERSION:
18+
File tempVuln = File.createTempFile("random", "file");
19+
20+
// TO MAKE SAFE REWRITE TO:
21+
File tempSafe = Files.createTempFile("random", "file").toFile();
1622
}
1723

1824
void vulnerableFileCreateTempFileNull() throws IOException {
19-
File temp = File.createTempFile("random", "file", null);
25+
// VULNERABLE VERSION:
26+
File tempVuln = File.createTempFile("random", "file", null);
27+
28+
// TO MAKE SAFE REWRITE TO:
29+
File tempSafe = Files.createTempFile("random", "file").toFile();
2030
}
2131

2232
void vulnerableFileCreateTempFileTainted() throws IOException {
33+
// GIVEN:
2334
File tempDir = new File(System.getProperty("java.io.tmpdir"));
24-
File temp = File.createTempFile("random", "file", tempDir);
35+
36+
// VULNERABLE VERSION:
37+
File tempVuln = File.createTempFile("random", "file", tempDir);
38+
39+
// TO MAKE SAFE REWRITE TO (v1):
40+
File tempSafe1 = Files.createTempFile(tempDir.toPath(), "random", "file").toFile();
41+
42+
// TO MAKE SAFE REWRITE TO (v2):
43+
File tempSafe2 = Files.createTempFile("random", "file").toFile();
2544
}
2645

2746
void vulnerableFileCreateTempFileChildTainted() throws IOException {
47+
// GIVEN:
2848
File tempDirChild = new File(new File(System.getProperty("java.io.tmpdir")), "/child");
29-
File temp = File.createTempFile("random", "file", tempDirChild);
49+
50+
// VULNERABLE VERSION:
51+
File tempVuln = File.createTempFile("random", "file", tempDirChild);
52+
53+
// TO MAKE SAFE REWRITE TO:
54+
File tempSafe = Files.createTempFile(tempDirChild.toPath(), "random", "file").toFile();
3055
}
3156

3257
void vulnerableFileCreateTempFileCanonical() throws IOException {
58+
// GIVEN:
3359
File tempDir = new File(System.getProperty("java.io.tmpdir")).getCanonicalFile();
34-
File temp = File.createTempFile("random", "file", tempDir);
60+
61+
// VULNERABLE VERSION:
62+
File tempVuln = File.createTempFile("random", "file", tempDir);
63+
64+
// TO MAKE SAFE REWRITE TO (v1):
65+
File tempSafe1 = Files.createTempFile(tempDir.toPath(), "random", "file").toFile();
66+
67+
// TO MAKE SAFE REWRITE TO (v2):
68+
File tempSafe2 = Files.createTempFile("random", "file").toFile();
3569
}
3670

3771
void vulnerableFileCreateTempFileAbsolute() throws IOException {
72+
// GIVEN:
3873
File tempDir = new File(System.getProperty("java.io.tmpdir")).getAbsoluteFile();
39-
File temp = File.createTempFile("random", "file", tempDir);
74+
75+
// VULNERABLE VERSION:
76+
File tempVuln = File.createTempFile("random", "file", tempDir);
77+
78+
// TO MAKE SAFE REWRITE TO (v1):
79+
File tempSafe1 = Files.createTempFile(tempDir.toPath(), "random", "file").toFile();
80+
// TO MAKE SAFE REWRITE TO (v2):
81+
File tempSafe2 = Files.createTempFile("random", "file").toFile();
4082
}
4183

4284
void safeFileCreateTempFileTainted() throws IOException {
43-
/* Creating a temporary directoy in the current user directory is not a vulnerability. */
85+
/*
86+
* Creating a temporary directoy in the current user directory is not a
87+
* vulnerability.
88+
*/
4489
File currentDirectory = new File(System.getProperty("user.dir"));
4590
File temp = File.createTempFile("random", "file", currentDirectory);
4691
}
4792

4893
void vulnerableGuavaFilesCreateTempDir() {
94+
// VULNERABLE VERSION:
4995
File tempDir = com.google.common.io.Files.createTempDir();
96+
97+
// TO MAKE SAFE REWRITE TO:
98+
File tempSafe;
99+
try {
100+
Files.createTempDirectory("random").toFile();
101+
} catch (IOException e) {
102+
throw new RuntimeException("Failed to create temporary directory", e);
103+
}
50104
}
51105

52106
void vulnerableFileCreateTempFileMkdirTainted() {
107+
// GIVEN:
53108
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child");
109+
110+
// VULNERABLE VERSION:
54111
tempDirChild.mkdir();
112+
113+
// TO MAKE SAFE REWRITE TO (v1):
114+
File tempSafe1;
115+
try {
116+
tempSafe1 = Files.createTempDirectory(tempDirChild.toPath(), "random").toFile();
117+
} catch (IOException e) {
118+
throw new RuntimeException("Failed to create temporary directory", e);
119+
}
120+
121+
// TO MAKE SAFE REWRITE TO (v2):
122+
File tempSafe2;
123+
try {
124+
tempSafe2 = Files.createTempDirectory("random").toFile();
125+
} catch (IOException e) {
126+
throw new RuntimeException("Failed to create temporary directory", e);
127+
}
55128
}
56129

57130
void vulnerableFileCreateTempFileMkdirsTainted() {
131+
// GIVEN:
58132
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child");
133+
134+
// VULNERABLE VERSION:
59135
tempDirChild.mkdirs();
136+
137+
// TO MAKE SAFE REWRITE TO (v1):
138+
File tempSafe1;
139+
try {
140+
tempSafe1 = Files.createTempDirectory(tempDirChild.toPath(), "random").toFile();
141+
} catch (IOException e) {
142+
throw new RuntimeException("Failed to create temporary directory", e);
143+
}
144+
145+
// TO MAKE SAFE REWRITE TO (v2):
146+
File tempSafe2;
147+
try {
148+
tempSafe2 = Files.createTempDirectory("random").toFile();
149+
} catch (IOException e) {
150+
throw new RuntimeException("Failed to create temporary directory", e);
151+
}
60152
}
61153

62154
void vulnerableFileCreateTempFilesWrite1() throws IOException {
155+
// VULNERABLE VERSION:
63156
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child.txt");
64157
Files.write(tempDirChild.toPath(), Arrays.asList("secret"), StandardCharsets.UTF_8, StandardOpenOption.CREATE);
158+
159+
// TO MAKE SAFE REWRITE TO (v1):
160+
// Use this version if you care that the file has the exact path of `[java.io.tmpdir]/child.txt`
161+
try {
162+
Path tempSafe = Paths.get(System.getProperty("java.io.tmpdir"), "child.txt");
163+
Files.createFile(tempSafe, PosixFilePermissions.asFileAttribute(EnumSet.of(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE)));
164+
Files.write(tempSafe, Arrays.asList("secret"));
165+
} catch (IOException e) {
166+
throw new RuntimeException("Failed to write temporary file", e);
167+
}
168+
169+
// TO MAKE SAFE REWRITE TO (v2):
170+
// Use this version if you don't care that the file has an exact path. This will write to a file of the name `[java.io.tmpdir]/random[random string]child.txt`
171+
try {
172+
Path tempSafe = Files.createTempFile("random", "child.txt");
173+
Files.write(tempSafe, Arrays.asList("secret"), StandardCharsets.UTF_8, StandardOpenOption.CREATE);
174+
} catch (IOException e) {
175+
throw new RuntimeException("Failed to write temporary file", e);
176+
}
65177
}
66-
178+
67179
void vulnerableFileCreateTempFilesWrite2() throws IOException {
68-
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child.txt");
180+
// GIVEN:
69181
String secret = "secret";
70182
byte[] byteArrray = secret.getBytes();
183+
184+
// VULNERABLE VERSION:
185+
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child.txt");
71186
Files.write(tempDirChild.toPath(), byteArrray, StandardOpenOption.CREATE);
187+
188+
// TO MAKE SAFE REWRITE TO (v1):
189+
// Use this version if you care that the file has the exact path of `[java.io.tmpdir]/child.txt`
190+
Path tempSafe1 = Paths.get(System.getProperty("java.io.tmpdir"), "child.txt");
191+
Files.createFile(tempSafe1, PosixFilePermissions.asFileAttribute(EnumSet.of(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE)));
192+
Files.write(tempSafe1, byteArrray);
193+
194+
// TO MAKE SAFE REWRITE TO (v2):
195+
// Use this version if you don't care that the file has an exact path. This will write to a file of the name `[java.io.tmpdir]/random[random string]child.txt`
196+
Path tempSafe2 = Files.createTempFile("random", "child.txt");
197+
Files.write(tempSafe2, byteArrray);
72198
}
73199

74200
void vulnerableFileCreateTempFilesNewBufferedWriter() throws IOException {
75-
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child-buffered-writer.txt");
76-
Files.newBufferedWriter(tempDirChild.toPath());
201+
// GIVEN:
202+
Path tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child-buffered-writer.txt").toPath();
203+
204+
// VULNERABLE VERSION:
205+
Files.newBufferedWriter(tempDirChild);
206+
207+
// TO MAKE SAFE REWRITE TO:
208+
Files.createFile(tempDirChild, PosixFilePermissions.asFileAttribute(EnumSet.of(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE)));
209+
Files.newBufferedWriter(tempDirChild);
77210
}
78211

79212
void vulnerableFileCreateTempFilesNewOutputStream() throws IOException {
80-
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child-output-stream.txt");
81-
Files.newOutputStream(tempDirChild.toPath()).close();
213+
// GIVEN:
214+
Path tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child-output-stream.txt").toPath();
215+
216+
// VULNERABLE VERSION:
217+
Files.newOutputStream(tempDirChild).close();
218+
219+
// TO MAKE SAFE REWRITE TO:
220+
Files.createFile(tempDirChild, PosixFilePermissions.asFileAttribute(EnumSet.of(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE)));
221+
Files.newOutputStream(tempDirChild).close();
82222
}
83223

84224
void vulnerableFileCreateTempFilesCreateFile() throws IOException {
225+
// GIVEN:
85226
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child-create-file.txt");
227+
228+
// VULNERABLE VERSION:
86229
Files.createFile(tempDirChild.toPath());
230+
231+
// TO MAKE SAFE REWRITE TO:
232+
Files.createFile(tempDirChild.toPath(), PosixFilePermissions.asFileAttribute(EnumSet.of(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE)));
87233
}
88234

89235
void safeFileCreateTempFilesCreateFile() throws IOException {
90-
// Clear permissions intentions by setting the 'OWNER_READ' and 'OWNER_WRITE' permissions.
236+
// Clear permissions intentions by setting the 'OWNER_READ' and 'OWNER_WRITE'
237+
// permissions.
91238
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child-create-file.txt");
92239
Files.createFile(
93-
tempDirChild.toPath(),
94-
PosixFilePermissions.asFileAttribute(EnumSet.of(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE))
95-
);
240+
tempDirChild.toPath(),
241+
PosixFilePermissions
242+
.asFileAttribute(EnumSet.of(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE)));
96243
}
97244

98245
void vulnerableFileCreateDirectory() throws IOException {
246+
// GIVEN:
99247
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child-create-directory");
248+
249+
// VULNERABLE VERSION:
100250
Files.createDirectory(tempDirChild.toPath()); // Creates with permissions 'drwxr-xr-x'
251+
252+
// TO MAKE SAFE REWRITE TO:
253+
Files.createDirectory(tempDirChild.toPath(), PosixFilePermissions.asFileAttribute(EnumSet.of(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE)));
101254
}
102255

103256
void vulnerableFileCreateDirectories() throws IOException {
257+
// GIVEN:
104258
File tempDirChild = new File(System.getProperty("java.io.tmpdir"), "/child-create-directories/child");
259+
260+
// VULNERABLE VERSION:
105261
Files.createDirectories(tempDirChild.toPath()); // Creates with permissions 'drwxr-xr-x'
262+
263+
// TO MAKE SAFE REWRITE TO:
264+
Files.createDirectories(tempDirChild.toPath(), PosixFilePermissions.asFileAttribute(EnumSet.of(PosixFilePermission.OWNER_READ, PosixFilePermission.OWNER_WRITE)));
106265
}
107266
}

0 commit comments

Comments
 (0)