From 491aa092b4be92786efa4dbfd3e0c1d1d467f5ef Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Lorenzo=20Dematt=C3=A9?= <lorenzo.dematte@elastic.co>
Date: Wed, 27 Aug 2025 15:19:03 +0200
Subject: [PATCH] Handle special cases for File.createTempFile (#133530)

We were missing a couple of cases where File.createTempFile (from java.io) are defaulting to the default temp directory.
This PR addresses that.

Fixes #130086
---
 .../entitlement/bridge/EntitlementChecker.java      |  2 ++
 .../entitlement/qa/test/FileCheckActions.java       | 11 +++++++++++
 .../policy/ElasticsearchEntitlementChecker.java     | 13 ++++++++++++-
 3 files changed, 25 insertions(+), 1 deletion(-)

diff --git a/libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java b/libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java
index 542999f5a5b0a..6b2a11efdd037 100644
--- a/libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java
+++ b/libs/entitlement/bridge/src/main/java/org/elasticsearch/entitlement/bridge/EntitlementChecker.java
@@ -709,6 +709,8 @@ public interface EntitlementChecker {
 
     void check$java_io_File$createNewFile(Class<?> callerClass, File file);
 
+    void check$java_io_File$$createTempFile(Class<?> callerClass, String prefix, String suffix);
+
     void check$java_io_File$$createTempFile(Class<?> callerClass, String prefix, String suffix, File directory);
 
     void check$java_io_File$delete(Class<?> callerClass, File file);
diff --git a/libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java b/libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java
index e80b0a8580b5e..0adfbf66c6a23 100644
--- a/libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java
+++ b/libs/entitlement/qa/entitlement-test-plugin/src/main/java/org/elasticsearch/entitlement/qa/test/FileCheckActions.java
@@ -97,6 +97,17 @@ static void fileCreateTempFile() throws IOException {
         File.createTempFile("prefix", "suffix", readWriteDir().toFile());
     }
 
+    @EntitlementTest(expectedAccess = ALWAYS_ALLOWED)
+    static void fileCreateTempFileSystemTempDirectory() throws IOException {
+        File.createTempFile("prefix", "suffix");
+    }
+
+    @EntitlementTest(expectedAccess = ALWAYS_ALLOWED)
+    static void fileCreateTempFileNullDirectory() throws IOException {
+        // null directory = system temp directory
+        File.createTempFile("prefix", "suffix", null);
+    }
+
     @EntitlementTest(expectedAccess = PLUGINS)
     static void fileDelete() throws IOException {
         var toDelete = EntitledActions.createTempFileForWrite();
diff --git a/libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/ElasticsearchEntitlementChecker.java b/libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/ElasticsearchEntitlementChecker.java
index 648572e3b4d65..4e3640fcef99e 100644
--- a/libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/ElasticsearchEntitlementChecker.java
+++ b/libs/entitlement/src/main/java/org/elasticsearch/entitlement/runtime/policy/ElasticsearchEntitlementChecker.java
@@ -1402,9 +1402,20 @@ public void checkSelectorProviderOpenSocketChannel(Class<?> callerClass, Selecto
         policyChecker.checkFileWrite(callerClass, file);
     }
 
+    @Override
+    public void check$java_io_File$$createTempFile(Class<?> callerClass, String prefix, String suffix) {
+        policyChecker.checkCreateTempFile(callerClass);
+    }
+
     @Override
     public void check$java_io_File$$createTempFile(Class<?> callerClass, String prefix, String suffix, File directory) {
-        policyChecker.checkFileWrite(callerClass, directory);
+        // A null value for the directory parameter means using the temp directory (java.io.tmpdir,
+        // aka org.elasticsearch.env.Environment#tmpDir, aka PathLookup#TEMP).
+        if (directory == null) {
+            policyChecker.checkCreateTempFile(callerClass);
+        } else {
+            policyChecker.checkFileWrite(callerClass, directory);
+        }
     }
 
     @Override