Skip to content

Commit 35adbd5

Browse files
authored
Merge pull request from GHSA-hpv8-9rq5-hq7w
security: fix CWE-378 CWE-200 CWE-732 - use java.nio.files
2 parents 987ea7a + 33a1ef4 commit 35adbd5

File tree

159 files changed

+178
-12652
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

159 files changed

+178
-12652
lines changed

bin/java-petstore-all.sh

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -12,7 +12,6 @@
1212
./bin/java-petstore-retrofit2rx2.sh
1313
./bin/java8-petstore-jersey2.sh
1414
./bin/java-petstore-retrofit2-play24.sh
15-
./bin/java-petstore-jersey2-java6.sh
1615
./bin/java-petstore-resttemplate.sh
1716
./bin/java-petstore-resttemplate-withxml.sh
1817
./bin/java-petstore-resteasy.sh

bin/java-petstore-jersey2-java6.sh

Lines changed: 0 additions & 34 deletions
This file was deleted.

modules/swagger-codegen/src/main/java/io/swagger/codegen/languages/AbstractJavaCodegen.java

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,7 @@ public void processOpts() {
198198
super.processOpts();
199199

200200
if (additionalProperties.containsKey(SUPPORT_JAVA6)) {
201-
this.setSupportJava6(Boolean.valueOf(additionalProperties.get(SUPPORT_JAVA6).toString()));
201+
this.setSupportJava6(false); // JAVA 6 not supported
202202
}
203203
additionalProperties.put(SUPPORT_JAVA6, supportJava6);
204204

modules/swagger-codegen/src/main/java/io/swagger/codegen/languages/JavaClientCodegen.java

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,6 @@ public JavaClientCodegen() {
6969
cliOptions.add(CliOption.newBoolean(PARCELABLE_MODEL, "Whether to generate models for Android that implement Parcelable with the okhttp-gson library."));
7070
cliOptions.add(CliOption.newBoolean(USE_PLAY_WS, "Use Play! Async HTTP client (Play WS API)"));
7171
cliOptions.add(CliOption.newString(PLAY_VERSION, "Version of Play! Framework (possible values \"play24\", \"play25\")"));
72-
cliOptions.add(CliOption.newBoolean(SUPPORT_JAVA6, "Whether to support Java6 with the Jersey1 library."));
7372
cliOptions.add(CliOption.newBoolean(USE_BEANVALIDATION, "Use BeanValidation API annotations"));
7473
cliOptions.add(CliOption.newBoolean(PERFORM_BEANVALIDATION, "Perform BeanValidation"));
7574
cliOptions.add(CliOption.newBoolean(USE_GZIP_FEATURE, "Send gzip-encoded requests"));

modules/swagger-codegen/src/main/java/io/swagger/codegen/languages/JavaJerseyServerCodegen.java

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ public class JavaJerseyServerCodegen extends AbstractJavaJAXRSServerCodegen {
1313

1414
protected static final String LIBRARY_JERSEY1 = "jersey1";
1515
protected static final String LIBRARY_JERSEY2 = "jersey2";
16-
16+
1717
/**
1818
* Default library template to use. (Default:{@value #DEFAULT_LIBRARY})
1919
*/
@@ -48,7 +48,6 @@ public JavaJerseyServerCodegen() {
4848
library.setDefault(DEFAULT_LIBRARY);
4949

5050
cliOptions.add(library);
51-
cliOptions.add(CliOption.newBoolean(SUPPORT_JAVA6, "Whether to support Java6 with the Jersey1/2 library."));
5251
cliOptions.add(CliOption.newBoolean(USE_TAGS, "use tags for creating interface and controller classnames"));
5352
}
5453

@@ -89,11 +88,11 @@ public void processOpts() {
8988
if (StringUtils.isEmpty(library)) {
9089
setLibrary(DEFAULT_LIBRARY);
9190
}
92-
91+
9392
if ( additionalProperties.containsKey(CodegenConstants.IMPL_FOLDER)) {
9493
implFolder = (String) additionalProperties.get(CodegenConstants.IMPL_FOLDER);
9594
}
96-
95+
9796
if (additionalProperties.containsKey(USE_TAGS)) {
9897
this.setUseTags(Boolean.valueOf(additionalProperties.get(USE_TAGS).toString()));
9998
}

modules/swagger-codegen/src/main/resources/Java/libraries/jersey2/ApiClient.mustache

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,6 +25,7 @@ import java.io.InputStream;
2525

2626
{{^supportJava6}}
2727
import java.nio.file.Files;
28+
import java.nio.file.Paths;
2829
import java.nio.file.StandardCopyOption;
2930
import org.glassfish.jersey.logging.LoggingFeature;
3031
{{/supportJava6}}
@@ -296,7 +297,7 @@ public class ApiClient {
296297
public int getReadTimeout() {
297298
return readTimeout;
298299
}
299-
300+
300301
/**
301302
* Set the read timeout (in milliseconds).
302303
* A value of 0 means no timeout, otherwise values must be between 1 and
@@ -628,9 +629,9 @@ public class ApiClient {
628629
}
629630

630631
if (tempFolderPath == null)
631-
return File.createTempFile(prefix, suffix);
632+
return Files.createTempFile(prefix, suffix).toFile();
632633
else
633-
return File.createTempFile(prefix, suffix, new File(tempFolderPath));
634+
return Files.createTempFile(Paths.get(tempFolderPath), prefix, suffix).toFile();
634635
}
635636

636637
/**

modules/swagger-codegen/src/main/resources/Java/libraries/okhttp-gson/ApiClient.mustache

Lines changed: 5 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,8 @@ import java.io.File;
2424
import java.io.IOException;
2525
import java.io.InputStream;
2626
import java.io.UnsupportedEncodingException;
27+
import java.nio.file.Files;
28+
import java.nio.file.Paths;
2729
import java.lang.reflect.Type;
2830
import java.net.URLConnection;
2931
import java.net.URLEncoder;
@@ -829,9 +831,9 @@ public class ApiClient {
829831
}
830832

831833
if (tempFolderPath == null)
832-
return File.createTempFile(prefix, suffix);
834+
return Files.createTempFile(prefix, suffix).toFile();
833835
else
834-
return File.createTempFile(prefix, suffix, new File(tempFolderPath));
836+
return Files.createTempFile(Paths.get(tempFolderPath), prefix, suffix).toFile();
835837
}
836838

837839
/**
@@ -981,7 +983,7 @@ public class ApiClient {
981983
* @param formParams The form parameters
982984
* @param authNames The authentications to apply
983985
* @param progressRequestListener Progress request listener
984-
* @return The HTTP request
986+
* @return The HTTP request
985987
* @throws ApiException If fail to serialize the request body object
986988
*/
987989
public Request buildRequest(String path, String method, List<Pair> queryParams, List<Pair> collectionQueryParams, Object body, Map<String, String> headerParams, Map<String, Object> formParams, String[] authNames, ProgressRequestBody.ProgressRequestListener progressRequestListener) throws ApiException {

modules/swagger-codegen/src/main/resources/Java/libraries/resteasy/ApiClient.mustache

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@ import java.io.InputStream;
88
import java.io.UnsupportedEncodingException;
99
import java.net.URLEncoder;
1010
import java.nio.file.Files;
11+
import java.nio.file.Paths;
1112
import java.text.DateFormat;
1213
import java.text.SimpleDateFormat;
1314
import java.util.ArrayList;
@@ -446,7 +447,7 @@ public class ApiClient {
446447
public Entity<?> serialize(Object obj, Map<String, Object> formParams, String contentType) throws ApiException {
447448
Entity<?> entity = null;
448449
if (contentType.startsWith("multipart/form-data")) {
449-
MultipartFormDataOutput multipart = new MultipartFormDataOutput();
450+
MultipartFormDataOutput multipart = new MultipartFormDataOutput();
450451
//MultiPart multiPart = new MultiPart();
451452
for (Entry<String, Object> param: formParams.entrySet()) {
452453
if (param.getValue() instanceof File) {
@@ -552,9 +553,9 @@ public class ApiClient {
552553
}
553554

554555
if (tempFolderPath == null)
555-
return File.createTempFile(prefix, suffix);
556+
return Files.createTempFile(prefix, suffix).toFile();
556557
else
557-
return File.createTempFile(prefix, suffix, new File(tempFolderPath));
558+
return Files.createTempFile(Paths.get(tempFolderPath), prefix, suffix).toFile();
558559
}
559560

560561
/**

modules/swagger-codegen/src/main/resources/finch/api.mustache

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,8 @@ import com.twitter.util.Future
1616
import com.twitter.io.Buf
1717
import io.finch._, items._
1818
import java.io.File
19+
import java.nio.file.Files
20+
import java.nio.file.Paths
1921
import java.time._
2022

2123
object {{classname}} {
@@ -81,7 +83,7 @@ object {{classname}} {
8183
}
8284

8385
private def bytesToFile(input: Array[Byte]): java.io.File = {
84-
val file = File.createTempFile("tmp{{classname}}", null)
86+
val file = Files.createTempFile("tmp{{classname}}", null).toFile()
8587
val output = new FileOutputStream(file)
8688
output.write(input)
8789
file

modules/swagger-codegen/src/main/resources/kotlin-client/infrastructure/ApiClient.kt.mustache

Lines changed: 8 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@ package {{packageName}}.infrastructure
33
import okhttp3.*
44
import java.io.File
55
import java.io.IOException
6+
import java.nio.file.Files;
67
import java.util.regex.Pattern
78

89
open class ApiClient(val baseUrl: String) {
@@ -64,15 +65,15 @@ open class ApiClient(val baseUrl: String) {
6465
6566
inline protected fun <reified T: Any?> responseBody(response: Response, mediaType: String = JsonMediaType): T? {
6667
if(response.body() == null) return null
67-
68+
6869
if(T::class.java == java.io.File::class.java){
6970
return downloadFileFromResponse(response) as T
7071
} else if(T::class == kotlin.Unit::class) {
7172
return kotlin.Unit as T
7273
}
73-
74+
7475
var contentType = response.headers().get("Content-Type")
75-
76+
7677
if(contentType == null) {
7778
contentType = JsonMediaType
7879
}
@@ -85,7 +86,7 @@ open class ApiClient(val baseUrl: String) {
8586
TODO("Fill in more types!")
8687
}
8788
}
88-
89+
8990
fun isJsonMime(mime: String?): Boolean {
9091
val jsonMime = "(?i)^(application/json|[^;/ \t]+/[^;/ \t]+[+]json)[ \t]*(;.*)?$"
9192
return mime != null && (mime.matches(jsonMime.toRegex()) || mime == "*/*")
@@ -162,7 +163,7 @@ open class ApiClient(val baseUrl: String) {
162163
)
163164
}
164165
}
165-
166+
166167
@Throws(IOException::class)
167168
fun downloadFileFromResponse(response: Response): File {
168169
val file = prepareDownloadFile(response)
@@ -206,6 +207,6 @@ open class ApiClient(val baseUrl: String) {
206207
prefix = "download-"
207208
}
208209

209-
return File.createTempFile(prefix, suffix);
210+
return Files.createTempFile(prefix, suffix).toFile();
210211
}
211-
}
212+
}

0 commit comments

Comments
 (0)