refactor: Java Security Ultimate Security Repo Scanner 2023

src/main/java/com/ning/http/client/multipart/MultipartUtils.java

@@ -35,6 +35,7 @@
 import java.nio.channels.Selector;
 import java.nio.channels.SocketChannel;
 import java.nio.channels.WritableByteChannel;
+import java.security.SecureRandom;
 import java.util.List;
 import java.util.Random;
 import java.util.Set;
@@ -95,7 +96,7 @@ public static MultipartBody newMultipartBody(List<Part> parts, FluentCaseInsensi
     }
 
     private static byte[] generateMultipartBoundary() {
-        Random rand = new Random();
+        Random rand = new SecureRandom();
         byte[] bytes = new byte[rand.nextInt(11) + 30]; // a random size from 30 to 40
         for (int i = 0; i < bytes.length; i++) {
             bytes[i] = MULTIPART_CHARS[rand.nextInt(MULTIPART_CHARS.length)];

src/main/java/com/ning/http/client/webdav/WebDavCompletionHandlerBase.java

@@ -252,6 +252,13 @@ public String getProtocolText() {
 
     private Document readXMLResponse(InputStream stream) {
         DocumentBuilderFactory factory = DocumentBuilderFactory.newInstance();
+        String FEATURE = "http://apache.org/xml/features/disallow-doctype-decl";
+        try {
+            factory.setFeature(FEATURE, true);
+        } catch (ParserConfigurationException e) {
+            throw new IllegalStateException("ParserConfigurationException was thrown. The feature '"
+                    + FEATURE + "' is not supported by your XML processor.", e);
+        }
         Document document = null;
         try {
             document = factory.newDocumentBuilder().parse(stream);

src/test/java/com/ning/http/client/async/ByteBufferCapacityTest.java

@@ -23,6 +23,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.io.OutputStream;
+import java.nio.file.Files;
 import java.util.Enumeration;
 import java.util.UUID;
 import java.util.concurrent.atomic.AtomicInteger;
@@ -114,7 +115,7 @@ public String getTargetUrl() {
     public static File createTempFile(byte[] pattern, int repeat) throws IOException {
         TMP.mkdirs();
         TMP.deleteOnExit();
-        File tmpFile = File.createTempFile("tmpfile-", ".data", TMP);
+        File tmpFile = Files.createTempFile(TMP.toPath(), "tmpfile-", ".data").toFile();
         write(pattern, repeat, tmpFile);
 
         return tmpFile;

src/test/java/com/ning/http/client/async/FilePartLargeFileTest.java

@@ -37,6 +37,7 @@
 import java.io.FileOutputStream;
 import java.io.IOException;
 import java.net.URL;
+import java.nio.file.Files;
 import java.util.UUID;
 
 public abstract class FilePartLargeFileTest extends AbstractBasicTest {
@@ -120,7 +121,7 @@ public void handle(String arg0, Request arg1, HttpServletRequest req, HttpServle
     public static File createTempFile(byte[] pattern, int repeat) throws IOException {
         TMP.mkdirs();
         TMP.deleteOnExit();
-        File tmpFile = File.createTempFile("tmpfile-", ".data", TMP);
+        File tmpFile = Files.createTempFile(TMP.toPath(), "tmpfile-", ".data").toFile();
         tmpFile.deleteOnExit();
         write(pattern, repeat, tmpFile);
 

src/test/java/com/ning/http/client/async/MultipartUploadTest.java

@@ -60,6 +60,7 @@
 import java.net.URI;
 import java.net.URISyntaxException;
 import java.net.URL;
+import java.nio.file.Files;
 import java.util.ArrayList;
 import java.util.Arrays;
 import java.util.List;
@@ -185,7 +186,7 @@ public void testSendingSmallFilesAndByteArray() throws IOException, InterruptedE
         gzipped.add(false);
 
         boolean tmpFileCreated = false;
-        File tmpFile = File.createTempFile("textbytearray", ".txt");
+        File tmpFile = Files.createTempFile("textbytearray", ".txt").toFile();
         try (FileOutputStream os = new FileOutputStream(tmpFile)) {
             IOUtils.write(expectedContents.getBytes("UTF-8"), os);
             tmpFileCreated = true;
@@ -416,7 +417,7 @@ public void service(HttpServletRequest request, HttpServletResponse response) th
                                 // Process the input stream
                                 OutputStream os = null;
                                 try {
-                                    File tmpFile = File.createTempFile(UUID.randomUUID().toString() + "_MockUploadServlet", ".tmp");
+                                    File tmpFile = Files.createTempFile(UUID.randomUUID().toString() + "_MockUploadServlet", ".tmp").toFile();
                                     tmpFile.deleteOnExit();
                                     os = new FileOutputStream(tmpFile);
                                     byte[] buffer = new byte[4096];

src/test/java/com/ning/http/client/async/PutLargeFileTest.java

@@ -31,6 +31,7 @@
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.UUID;
 
 /**
@@ -110,7 +111,7 @@ public void handle(String arg0, Request arg1, HttpServletRequest req, HttpServle
     public static File createTempFile(byte[] pattern, int repeat) throws IOException {
         TMP.mkdirs();
         TMP.deleteOnExit();
-        File tmpFile = File.createTempFile("tmpfile-", ".data", TMP);
+        File tmpFile = Files.createTempFile(TMP.toPath(), "tmpfile-", ".data").toFile();
         tmpFile.deleteOnExit();
         write(pattern, repeat, tmpFile);
 

src/test/java/com/ning/http/client/async/SimpleAsyncHttpClientTest.java

@@ -34,6 +34,7 @@
 import java.io.ByteArrayOutputStream;
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.Future;
 
@@ -118,7 +119,7 @@ public void testPutZeroBytesFileTest() throws Throwable {
         SimpleAsyncHttpClient client = new SimpleAsyncHttpClient.Builder().setProviderClass(getProviderClass()).setPooledConnectionIdleTimeout(100).setMaximumConnectionsTotal(50).setRequestTimeout(5 * 1000).setUrl(getTargetUrl() + "/testPutZeroBytesFileTest.txt").setHeader("Content-Type", "text/plain")
                 .build();
         try {
-            File tmpfile = File.createTempFile("testPutZeroBytesFile", ".tmp");
+            File tmpfile = Files.createTempFile("testPutZeroBytesFile", ".tmp").toFile();
             tmpfile.deleteOnExit();
 
             Future<Response> future = client.put(new FileBodyGenerator(tmpfile));

src/test/java/com/ning/http/client/async/TransferListenerTest.java

@@ -35,6 +35,7 @@
 import java.io.File;
 import java.io.FileOutputStream;
 import java.io.IOException;
+import java.nio.file.Files;
 import java.util.Enumeration;
 import java.util.UUID;
 import java.util.concurrent.atomic.AtomicBoolean;
@@ -240,7 +241,7 @@ public String getTargetUrl() {
     public static File createTempFile(byte[] pattern, int repeat) throws IOException {
         TMP.mkdirs();
         TMP.deleteOnExit();
-        File tmpFile = File.createTempFile("tmpfile-", ".data", TMP);
+        File tmpFile = Files.createTempFile(TMP.toPath(), "tmpfile-", ".data").toFile();
         write(pattern, repeat, tmpFile);
 
         return tmpFile;

src/test/java/com/ning/http/client/async/grizzly/GrizzlyFeedableBodyGeneratorTest.java

@@ -27,6 +27,7 @@
 import java.io.IOException;
 import java.io.InputStream;
 import java.net.URL;
+import java.nio.file.Files;
 import java.util.Random;
 import java.util.concurrent.CountDownLatch;
 import java.util.concurrent.ExecutorService;
@@ -356,7 +357,7 @@ private static SSLEngineConfigurator createSSLConfig()
 
 
     private void generateTempFile() throws IOException {
-        tempFile = File.createTempFile("feedable", null);
+        tempFile = Files.createTempFile("feedable", null).toFile();
         int total = 0;
         byte[] chunk = new byte[1024];
         Random r = new Random(System.currentTimeMillis());