vuln-fix: Temporary Directory Hijacking or Information Disclosure

This fixes either Temporary Directory Hijacking, or Temporary Directory Local Information Disclosure.

Weakness: CWE-379: Creation of Temporary File in Directory with Insecure Permissions
Severity: High
CVSSS: 7.3
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.UseFilesCreateTempDirectory)

Reported-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>
Signed-off-by: Jonathan Leitschuh <Jonathan.Leitschuh@gmail.com>

Bug-tracker: JLLeitschuh/security-research#10

Co-authored-by: Moderne <team@moderne.io>

src/test/java/net/sourceforge/jenesis4java/impl/test/Test.java

@@ -37,6 +37,7 @@
  */
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 
 import net.sourceforge.jenesis4java.AbstractMethod;
 import net.sourceforge.jenesis4java.Access;
@@ -96,9 +97,7 @@ public class Test {
     @org.junit.Test
     public void test1() throws IOException {
         this.vm = VirtualMachine.getVirtualMachine();
-        File tempDirectory = File.createTempFile("jenesisTmp", "tmp");
-        tempDirectory.delete();
-        tempDirectory.mkdirs();
+        File tempDirectory = Files.createTempDirectory("jenesisTmp" + "tmp").toFile();
         // make a new compilation unit
         CompilationUnit unit = this.vm.newCompilationUnit(tempDirectory.getCanonicalPath());
 

src/test/java/net/sourceforge/jenesis4java/impl/test/Test2.java

@@ -37,6 +37,7 @@
  */
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.HashSet;
 import java.util.List;
@@ -127,9 +128,7 @@ private String importResolvedClassName(String className) {
 
     @Test
     public void test2() throws IOException {
-        File tempDirectory = File.createTempFile("jenesisTmp", "tmp");
-        tempDirectory.delete();
-        tempDirectory.mkdirs();
+        File tempDirectory = Files.createTempDirectory("jenesisTmp" + "tmp").toFile();
         // make a new compilation unit
         CompilationUnit unit = this.vm.newCompilationUnit(tempDirectory.getCanonicalPath());
 

src/test/java/net/sourceforge/jenesis4java/impl/test/TestAnnotation.java

@@ -41,6 +41,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 
 import net.sourceforge.jenesis4java.Access;
 import net.sourceforge.jenesis4java.Annotation;
@@ -59,9 +60,7 @@ public class TestAnnotation {
     public void test3() throws IOException {
 
         VirtualMachine vm = VirtualMachine.getVirtualMachine();
-        File tempDirectory = File.createTempFile("jenesisTmp", "tmp");
-        tempDirectory.delete();
-        tempDirectory.mkdirs();
+        File tempDirectory = Files.createTempDirectory("jenesisTmp" + "tmp").toFile();
         // make a new compilation unit
         CompilationUnit unit = vm.newCompilationUnit(tempDirectory.getCanonicalPath());
         PackageClass cls = unit.newClass("HelloWorld");