vuln-fix: Temporary File Information Disclosure

This fixes temporary file information disclosure vulnerability due to the use
of the vulnerable `File.createTempFile()` method. The vulnerability is fixed by
using the `Files.createTempFile()` method which sets the correct posix permissions.

Weakness: CWE-377: Insecure Temporary File
Severity: Medium
CVSSS: 5.5
Detection: CodeQL & OpenRewrite (https://public.moderne.io/recipes/org.openrewrite.java.security.SecureTempFileCreation)

Reported-by: Jonathan Leitschuh <[email protected]>
Signed-off-by: Jonathan Leitschuh <[email protected]>

Bug-tracker: JLLeitschuh/security-research#18


Co-authored-by: Moderne <[email protected]>

Author: JLLeitschuh

joyqueue-common/joyqueue-toolkit/src/test/java/org/joyqueue/toolkit/os/SystemsTest.java

@@ -22,6 +22,7 @@
 
 import java.io.File;
 import java.io.IOException;
+import java.nio.file.Files;
 
 /**
  * Created by hexiaofeng on 16-7-4.
@@ -32,7 +33,7 @@ public class SystemsTest {
     public void testGetCores() throws IOException {
         System.out.println(Systems.getCores());
         Systems.JDOS1CoresDetector.ETC_CONFIG_INFO = "";
-        File file = File.createTempFile("config_info", "");
+        File file = Files.createTempFile("config_info", "").toFile();
         Files.write(file,
                 "{\"Config\": {\"Cpuset\": \"1,2\", \"Memory\": 4294967296}, \"host_ip\": \"10.8.65" + ".251\"}");
         String config = Systems.JDOS1CoresDetector.ETC_CONFIG_INFO;