From 83db1555233d219fe0d8642a16ef64fc127ada54 Mon Sep 17 00:00:00 2001
From: Valery Kharseko <vharseko@3a-systems.ru>
Date: Mon, 27 Jul 2026 13:22:06 +0000
Subject: [PATCH] Fix java/local-temp-file-or-directory-information-disclosure CodeQL alerts by using NIO temp file APIs (#763)
---
opendj-server-legacy/src/main/java/org/opends/server/schema/SchemaFilesWriter.java | 16 +++++++++++++++-
1 files changed, 15 insertions(+), 1 deletions(-)
diff --git a/opendj-server-legacy/src/main/java/org/opends/server/schema/SchemaFilesWriter.java b/opendj-server-legacy/src/main/java/org/opends/server/schema/SchemaFilesWriter.java
index 010f881..8f74982 100644
--- a/opendj-server-legacy/src/main/java/org/opends/server/schema/SchemaFilesWriter.java
+++ b/opendj-server-legacy/src/main/java/org/opends/server/schema/SchemaFilesWriter.java
@@ -13,6 +13,7 @@
*
* Copyright 2006-2010 Sun Microsystems, Inc.
* Portions Copyright 2011-2016 ForgeRock AS.
+ * Portions Copyright 2026 3A Systems, LLC.
*/
package org.opends.server.schema;
@@ -40,6 +41,7 @@
import java.io.IOException;
import java.nio.file.Files;
import java.nio.file.StandardCopyOption;
+import java.nio.file.attribute.PosixFilePermission;
import java.text.ParseException;
import java.util.ArrayList;
import java.util.Collection;
@@ -725,7 +727,7 @@
}
// Create a temporary file to which we can write the schema entry.
- File tempFile = File.createTempFile(schemaFile, "temp");
+ File tempFile = Files.createTempFile(schemaFile, "temp").toFile();
LDIFExportConfig exportConfig =
new LDIFExportConfig(tempFile.getAbsolutePath(),
ExistingFileBehavior.OVERWRITE);
@@ -1064,11 +1066,23 @@
// files. If this fails, then try to restore the originals.
try
{
+ boolean posixSupported = schemaInstanceDir.toPath().getFileSystem()
+ .supportedFileAttributeViews().contains("posix");
for (int i=0; i < installedFileList.size(); i++)
{
File installedFile = installedFileList.get(i);
File tempFile = tempFileList.get(i);
+ // The temporary file was created with owner-only permissions and Files.copy
+ // propagates the source permissions, so preserve the permissions of the
+ // previously installed schema file.
+ Set<PosixFilePermission> previousPermissions = posixSupported && installedFile.exists()
+ ? Files.getPosixFilePermissions(installedFile.toPath())
+ : null;
Files.copy(tempFile.toPath(), installedFile.toPath(), StandardCopyOption.REPLACE_EXISTING);
+ if (previousPermissions != null)
+ {
+ Files.setPosixFilePermissions(installedFile.toPath(), previousPermissions);
+ }
}
}
catch (Exception e)
--
Gitblit v1.10.0