Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
vuln-fix: Temporary Directory Hijacking or Information Disclosure (#389)
Simplify the creation of temp dir in FileMatchersTest This was originally identified as a security vulnerability (see details below), but inspection of the code showed that the vulnerability was not actually present in the code, as the original code does check the return code of `directory.delete()` and `directory.mkdirs()`. The PR was accepted because the change actually is an improvement to the code anyway. Weakness: CWE-379: Creation of Temporary File in Directory with Insecure Permissions Severity: High CVSSS: 7.3 Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.UseFilesCreateTempDirectory) Reported-by: Jonathan Leitschuh <[email protected]> Bug-tracker: JLLeitschuh/security-research#10 Co-authored-by: Moderne <[email protected]>
- Loading branch information