[SECURITY] Fix Temporary File Information Disclosure Vulnerability

vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/PropertyValueArtifact.java

@@ -22,6 +22,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.nio.file.Files;
 import java.util.Collection;
 import java.util.LinkedList;
 
@@ -162,7 +163,7 @@ public void detach() throws IOException, RepositoryException {
             // ensure caching of content type
             getContentType();
             // copy value to temp file
-            tmpFile = File.createTempFile("jcrfs", "dat");
+            tmpFile = Files.createTempFile("jcrfs", "dat").toFile();
             tmpFile.setLastModified(getLastModified());
             tmpFile.deleteOnExit();
             try (FileOutputStream out = new FileOutputStream(tmpFile);
@@ -371,4 +372,4 @@ public boolean markSupported() {
         }
     }
 
-}
+}

vault-core/src/main/java/org/apache/jackrabbit/vault/fs/impl/VaultFileOutputImpl.java

@@ -21,6 +21,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.nio.file.Files;
 
 import javax.jcr.RepositoryException;
 
@@ -61,7 +62,7 @@ public OutputStream getOutputStream() throws IOException {
         if (out != null) {
             throw new IOException("Output stream already obtained.");
         }
-        tmpFile = File.createTempFile("vltfs", ".tmp");
+        tmpFile = Files.createTempFile("vltfs", ".tmp").toFile();
         tmpFile.deleteOnExit();
         out = new FileOutputStream(tmpFile);
         return out;
@@ -85,4 +86,4 @@ public void close() throws IOException, RepositoryException {
         }
     }
 
-}
+}

vault-core/src/main/java/org/apache/jackrabbit/vault/fs/io/ZipStreamArchive.java

@@ -22,6 +22,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.RandomAccessFile;
+import java.nio.file.Files;
 import java.util.Collection;
 import java.util.Collections;
 import java.util.LinkedHashMap;
@@ -232,7 +233,7 @@ private long copyToBuffer(@NotNull InputStream in) throws IOException {
             pos += read;
             if (pos == decompressed.length) {
                 // switch to raf
-                tmpFile = File.createTempFile("__vlttmpbuffer", ".dat");
+                tmpFile = Files.createTempFile("__vlttmpbuffer", ".dat").toFile();
                 raf = new RandomAccessFile(tmpFile, "rw");
                 raf.write(decompressed);
                 decompressed = null;

vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/impl/JcrPackageImpl.java

@@ -21,6 +21,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.HashMap;
@@ -321,7 +322,7 @@ protected VaultPackage getPackage(boolean forceFileArchive) throws RepositoryExc
                     throw new IOException("Error while reading stream", e);
                 }
             } else {
-                File tmpFile = File.createTempFile("vaultpack", ".zip");
+                File tmpFile = Files.createTempFile("vaultpack", ".zip").toFile();
                 Binary bin = getData().getBinary();
                 try (FileOutputStream out = FileUtils.openOutputStream(tmpFile); 
                     InputStream in = bin.getStream()) {

vault-core/src/main/java/org/apache/jackrabbit/vault/packaging/impl/PackageManagerImpl.java

@@ -24,6 +24,7 @@
 import java.io.InputStream;
 import java.io.OutputStream;
 import java.net.URISyntaxException;
+import java.nio.file.Files;
 import java.util.Collections;
 import java.util.HashSet;
 import java.util.Set;
@@ -109,7 +110,7 @@ public VaultPackage assemble(Session s, ExportOptions opts, File file)
         boolean success = false;
         try {
             if (file == null) {
-                file = File.createTempFile("filevault", ".zip");
+                file = Files.createTempFile("filevault", ".zip").toFile();
                 isTmp = true;
             }
             out = FileUtils.openOutputStream(file);
@@ -176,7 +177,7 @@ public VaultPackage rewrap(ExportOptions opts, VaultPackage src, File file)
         boolean isTmp = false;
         boolean success = false;
         if (file == null) {
-            file = File.createTempFile("filevault", ".zip");
+            file = Files.createTempFile("filevault", ".zip").toFile();
             isTmp = true;
         }
         try (OutputStream out = FileUtils.openOutputStream(file);){

vault-core/src/test/java/org/apache/jackrabbit/vault/fs/io/JarExporterTest.java

@@ -27,6 +27,7 @@
 import java.io.FileInputStream;
 import java.io.IOException;
 import java.io.InputStream;
+import java.nio.file.Files;
 import java.util.Date;
 import java.util.zip.ZipException;
 
@@ -54,7 +55,7 @@ public class JarExporterTest {
     public void testEntriesWithSuppressedCompression() throws RepositoryException, IOException {
         Mocks m = new Mocks("org/apache/jackrabbit/vault/fs/io/JarExporter/testEntriesWithSuppressedCompression");
         for (int level : new int[] { NO_COMPRESSION, BEST_COMPRESSION, BEST_SPEED }) {
-            File target = File.createTempFile("testEntriesWithSuppressedCompression", ".zip", null);
+            File target = Files.createTempFile("testEntriesWithSuppressedCompression", ".zip").toFile();
             ZipStreamArchive archive = null;
             try {
                 JarExporter exporter = new JarExporter(target, level);

vault-core/src/test/java/org/apache/jackrabbit/vault/packaging/integration/ACEsAtRootIT.java

@@ -21,6 +21,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.io.OutputStream;
+import java.nio.file.Files;
 import java.security.Principal;
 import java.util.Properties;
 import java.util.zip.Deflater;
@@ -121,7 +122,7 @@ public void export() throws RepositoryException, IOException, PackageException,
         opts.setRootPath("/");
         opts.setCompressionLevel(Deflater.BEST_SPEED);
 
-        File tmpFile = File.createTempFile("vaulttest", ".zip");
+        File tmpFile = Files.createTempFile("vaulttest", ".zip").toFile();
         OutputStream os = new FileOutputStream(tmpFile);
         Session session = repository.login(new SimpleCredentials(userId, userPwd.toCharArray()));
         packMgr.assemble(admin, opts, os);

vault-core/src/test/java/org/apache/jackrabbit/vault/packaging/integration/EscapedExportIT.java

@@ -20,6 +20,7 @@
 import java.io.ByteArrayInputStream;
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Properties;
 
 import javax.jcr.Node;
@@ -113,7 +114,7 @@ public void unicodeEscapedPropertiesExportAndImportOk() throws IOException, Repo
     }
 
     private void assembleAndReinstallPackage() throws IOException, PackageException, RepositoryException {
-        File pkgFile = File.createTempFile("vaulttest", ".zip");
+        File pkgFile = Files.createTempFile("vaulttest", ".zip").toFile();
 
         try {
             ExportOptions options = new ExportOptions();
@@ -139,4 +140,4 @@ private void assembleAndReinstallPackage() throws IOException, PackageException,
         }
     }
 
-}
+}

vault-core/src/test/java/org/apache/jackrabbit/vault/packaging/integration/ExportWithQuotedPatternIT.java

@@ -18,6 +18,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Properties;
 import java.util.regex.Pattern;
 
@@ -79,7 +80,7 @@ public void quotedPattern() throws IOException, RepositoryException, PackageExce
     private File assemblePackage(WorkspaceFilter filter)
             throws IOException, RepositoryException {
 
-        File tmpFile = File.createTempFile("vaulttest", ".zip");
+        File tmpFile = Files.createTempFile("vaulttest", ".zip").toFile();
 
         ExportOptions options = new ExportOptions();
         DefaultMetaInf meta = new DefaultMetaInf();

vault-core/src/test/java/org/apache/jackrabbit/vault/packaging/integration/FilteredPropertiesIT.java

@@ -23,6 +23,7 @@
 import java.io.File;
 import java.io.IOException;
 import java.nio.charset.StandardCharsets;
+import java.nio.file.Files;
 import java.util.Properties;
 
 import javax.jcr.Node;
@@ -531,7 +532,7 @@ private Node setupProperties(Node node)
     private File assemblePackage(WorkspaceFilter filter)
             throws IOException, RepositoryException {
 
-        File tmpFile = File.createTempFile("vaulttest", ".zip");
+        File tmpFile = Files.createTempFile("vaulttest", ".zip").toFile();
         packMgr.assemble(admin, createExportOptions(filter), tmpFile).close();
         return tmpFile;
     }
@@ -566,4 +567,4 @@ private void assertPropertiesMissg(String rootPath, String... propNames)
         }
     }
 
-}
+}

vault-core/src/test/java/org/apache/jackrabbit/vault/packaging/integration/ManifestCreationExportIT.java

@@ -19,6 +19,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Collections;
 import java.util.Properties;
 
@@ -58,7 +59,7 @@ public void exportPackageCreatesManifest() throws RepositoryException, IOExcepti
         inf.setProperties(props);
 
         opts.setMetaInf(inf);
-        File tmpFile = File.createTempFile("e-vaulttest", ".zip");
+        File tmpFile = Files.createTempFile("e-vaulttest", ".zip").toFile();
         try (VaultPackage pkg = packMgr.assemble(admin, opts, tmpFile)) {
             String expected =
                     "Content-Package-Dependencies:foo:bar:[1.0,2.0)\n" +
@@ -73,4 +74,4 @@ public void exportPackageCreatesManifest() throws RepositoryException, IOExcepti
         }
     }
 
-}
+}

vault-core/src/test/java/org/apache/jackrabbit/vault/packaging/integration/MappedExportIT.java

@@ -19,6 +19,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Properties;
 
 import javax.jcr.RepositoryException;
@@ -58,7 +59,7 @@ public void exportMapped() throws RepositoryException, IOException, PackageExcep
         opts.setMetaInf(inf);
         opts.setMountPath("/tmp/foo");
         opts.setRootPath("/content/geometrixx");
-        File tmpFile = File.createTempFile("vaulttest", "zip");
+        File tmpFile = Files.createTempFile("vaulttest", "zip").toFile();
         VaultPackage pkg = packMgr.assemble(admin, opts, tmpFile);
 
         // check if entries are present
@@ -69,4 +70,4 @@ public void exportMapped() throws RepositoryException, IOException, PackageExcep
         tmpFile.delete();
     }
 
-}
+}

vault-core/src/test/java/org/apache/jackrabbit/vault/packaging/integration/NamespaceImportIT.java

@@ -22,6 +22,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Properties;
 
 import javax.jcr.NamespaceException;
@@ -107,7 +108,7 @@ public void importClashingNamespace() throws RepositoryException, IOException, P
         inf.setProperties(props);
         opts.setMetaInf(inf);
 
-        File tmpFile = File.createTempFile("vaulttest", "zip");
+        File tmpFile = Files.createTempFile("vaulttest", "zip").toFile();
         try (VaultPackage pkg = sourceOakRepository.packMgr.assemble(sourceOakRepository.admin, opts, tmpFile)) {
             Archive archive = pkg.getArchive();
 
@@ -142,7 +143,7 @@ public void importClashingNamespaceOnPath() throws RepositoryException, IOExcept
         inf.setProperties(props);
         opts.setMetaInf(inf);
 
-        File tmpFile = File.createTempFile("vaulttest", "zip");
+        File tmpFile = Files.createTempFile("vaulttest", "zip").toFile();
         try (VaultPackage pkg = sourceOakRepository.packMgr.assemble(sourceOakRepository.admin, opts, tmpFile)) {
             Archive archive = pkg.getArchive();
 

vault-core/src/test/java/org/apache/jackrabbit/vault/packaging/integration/PackageTypesIT.java

@@ -19,6 +19,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Properties;
 
 import javax.jcr.RepositoryException;
@@ -77,7 +78,7 @@ private void verifyPackageTypeViaPackageCreation(WorkspaceFilter filter, Package
 
         options.setMetaInf(meta);
 
-        File tmpFile = File.createTempFile("vaulttest", "zip");
+        File tmpFile = Files.createTempFile("vaulttest", "zip").toFile();
         try (VaultPackage pkg = packMgr.assemble(admin, options, tmpFile)) {
             PackageType result = pkg.getProperties().getPackageType();
             assertEquals("Package type", expected, result);
@@ -159,4 +160,4 @@ public void test_export_mixed() throws IOException, RepositoryException {
         filter.add(new PathFilterSet("/libs/foo"));
         verifyPackageTypeViaPackageCreation(filter, PackageType.MIXED);
     }
-}
+}

vault-core/src/test/java/org/apache/jackrabbit/vault/packaging/integration/SerializationIT.java

@@ -22,6 +22,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Properties;
 
 import javax.jcr.Node;
@@ -59,7 +60,7 @@ public void exportJcrXmlTest() throws RepositoryException, IOException, PackageE
         inf.setProperties(props);
 
         opts.setMetaInf(inf);
-        File tmpFile = File.createTempFile("vaulttest", "zip");
+        File tmpFile = Files.createTempFile("vaulttest", "zip").toFile();
         VaultPackage pkg = packMgr.assemble(admin, opts, tmpFile);
 
         // check if entries are present
@@ -81,4 +82,4 @@ public void exportJcrXmlTest() throws RepositoryException, IOException, PackageE
         tmpFile.delete();
     }
 
-}
+}

vault-core/src/test/java/org/apache/jackrabbit/vault/packaging/integration/SpecialDoublePropertiesIT.java

@@ -21,6 +21,7 @@
 import java.io.IOException;
 import java.io.InputStreamReader;
 import java.io.Reader;
+import java.nio.file.Files;
 import java.util.Properties;
 
 import javax.jcr.Node;
@@ -64,7 +65,7 @@ public void exportDoubles() throws RepositoryException, IOException, PackageExce
         inf.setProperties(props);
 
         opts.setMetaInf(inf);
-        File tmpFile = File.createTempFile("vaulttest", ".zip");
+        File tmpFile = Files.createTempFile("vaulttest", ".zip").toFile();
         VaultPackage pkg = packMgr.assemble(admin, opts, tmpFile);
 
         Archive.Entry e = pkg.getArchive().getEntry("jcr_root/tmp/.content.xml");
@@ -100,4 +101,4 @@ public void importDoubles() throws RepositoryException, IOException, PackageExce
         assertEquals(Double.NEGATIVE_INFINITY, tmp.getProperty("double_neg_inf").getDouble(), 0.0);
     }
 
-}
+}

vault-core/src/test/java/org/apache/jackrabbit/vault/packaging/integration/UserContentPackageIT.java

@@ -19,6 +19,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Properties;
 
 import javax.jcr.Node;
@@ -507,12 +508,12 @@ private File createPackage(String group, String name, String... paths) throws Re
 
         opts.setMetaInf(inf);
 
-        File tmpFile = File.createTempFile("vaulttest", ".zip");
+        File tmpFile = Files.createTempFile("vaulttest", ".zip").toFile();
         VaultPackage pkg = packMgr.assemble(admin, opts, tmpFile);
 
         pkg.close();
 
         return tmpFile;
     }
 
-}
+}