Skip to content

[9.1] Handle special cases for File.createTempFile (#133530) #133646

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Aug 27, 2025
Merged

[9.1] Handle special cases for File.createTempFile (#133530) #133646

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions ...tlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -771,6 +771,8 @@ public interface EntitlementChecker {

void check$java_io_File$createNewFile(Class<?> callerClass, File file);

void check$java_io_File$$createTempFile(Class<?> callerClass, String prefix, String suffix);

void check$java_io_File$$createTempFile(Class<?> callerClass, String prefix, String suffix, File directory);

void check$java_io_File$delete(Class<?> callerClass, File file);
Expand Down
11 changes: 11 additions & 0 deletions ...ent-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -97,6 +97,17 @@ static void fileCreateTempFile() throws IOException {
File.createTempFile("prefix", "suffix", readWriteDir().toFile());
}

@EntitlementTest(expectedAccess = ALWAYS_ALLOWED)
static void fileCreateTempFileSystemTempDirectory() throws IOException {
File.createTempFile("prefix", "suffix");
}

@EntitlementTest(expectedAccess = ALWAYS_ALLOWED)
static void fileCreateTempFileNullDirectory() throws IOException {
// null directory = system temp directory
File.createTempFile("prefix", "suffix", null);
}

@EntitlementTest(expectedAccess = PLUGINS)
static void fileDelete() throws IOException {
var toDelete = EntitledActions.createTempFileForWrite();
Expand Down
13 changes: 12 additions & 1 deletion ...in/java/org/elasticsearch/entitlement/runtime/policy/ElasticsearchEntitlementChecker.java
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1489,9 +1489,20 @@ public void checkSelectorProviderOpenSocketChannel(Class<?> callerClass, Selecto
policyChecker.checkFileWrite(callerClass, file);
}

@Override
public void check$java_io_File$$createTempFile(Class<?> callerClass, String prefix, String suffix) {
policyChecker.checkCreateTempFile(callerClass);
}

@Override
public void check$java_io_File$$createTempFile(Class<?> callerClass, String prefix, String suffix, File directory) {
policyChecker.checkFileWrite(callerClass, directory);
// A null value for the directory parameter means using the temp directory (java.io.tmpdir,
// aka org.elasticsearch.env.Environment#tmpDir, aka PathLookup#TEMP).
if (directory == null) {
policyChecker.checkCreateTempFile(callerClass);
} else {
policyChecker.checkFileWrite(callerClass, directory);
}
}

@Override
Expand Down