Contents
V5329. OWASP. Using non-atomic file creation is not recommended because an attacker might intercept file ownership.
The analyzer has detected the use of an insecure method for creating temporary files. This can expose the application to attacks via the file system.
This vulnerability can be categorized under the OWASP Top 10 2021 classification as follows:
Calling the insecure createTempFile method from the java.io.File class is considered inherently insecure if it is executed along with a call to the mkdir or mkdirs methods:
public File createTemporaryDirectory() {
File dir = new File(baseDirFactory.create(),
CollectionUtils.join("/", path));
GFileUtils.mkdirs(dir);
try {
File tmpDir = File.createTempFile("gradle",
"projectDir",
dir);
tmpDir.delete();
tmpDir.mkdir();
return tmpDir;
} catch (IOException e) {
throw new UncheckedIOException(e);
}
}Creating temporary files in a non-atomic way can lead to a race condition in the application behavior. This allows a third party to create the file at the moment when the application selects its name and it actually creates it. In this case, the application may use a file it does not truly control.
Attackers can gain access to and control over a vulnerable application's temporary file and modify it, potentially altering the application logic.
To harden security, create the temporary file using the createTempDirectory method from the java.nio.file.Files class:
public File createTemporaryDirectory() {
try {
File dir = new File(baseDirFactory.create(),
CollectionUtils.join("/", path));
GFileUtils.mkdirs(dir);
Path tempDir = Files.createTempDirectory(dir.toPath(),
"gradle");
return tempDir.toFile();
} catch (IOException e) {
throw new UncheckedIOException(e);
}
}This diagnostic is classified as:
Was this page helpful?
