jetty/CVE-2020-27216.patch
2021-02-08 16:26:49 +08:00

66 lines
2.6 KiB
Diff

From 53e0e0e9b25a6309bf24ee3b10984f4145701edb Mon Sep 17 00:00:00 2001
From: Joakim Erdfelt <joakim.erdfelt@gmail.com>
Date: Thu, 15 Oct 2020 17:39:30 -0500
Subject: [PATCH] Merge pull request from GHSA-g3wg-6mcf-8jj6
* Issue #5451 - Improving temp directory creation.
+ Using new Files.createTempDirectory() instead
of nonsense around File.createTempFile()
Signed-off-by: Joakim Erdfelt <joakim.erdfelt@gmail.com>
* Fixes #5451 - Restoring File.deleteOnExit
---
.../jetty/webapp/WebInfConfiguration.java | 20 +++++++------------
1 file changed, 7 insertions(+), 13 deletions(-)
diff --git a/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java b/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java
index b94f788..f39432d 100644
--- a/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java
+++ b/jetty-webapp/src/main/java/org/eclipse/jetty/webapp/WebInfConfiguration.java
@@ -24,6 +24,8 @@ import java.net.URI;
import java.net.URISyntaxException;
import java.net.URL;
import java.net.URLClassLoader;
+import java.nio.file.Files;
+import java.nio.file.Path;
import java.util.ArrayList;
import java.util.Arrays;
import java.util.List;
@@ -384,14 +386,10 @@ public class WebInfConfiguration extends AbstractConfiguration
@Override
public void cloneConfigure(WebAppContext template, WebAppContext context) throws Exception
{
- File tmpDir=File.createTempFile(WebInfConfiguration.getCanonicalNameForWebAppTmpDir(context),"",template.getTempDirectory().getParentFile());
- if (tmpDir.exists())
- {
- IO.delete(tmpDir);
- }
- tmpDir.mkdir();
- tmpDir.deleteOnExit();
- context.setTempDirectory(tmpDir);
+ Path tmpDir = Files.createTempDirectory(template.getTempDirectory().getParentFile().toPath(), WebInfConfiguration.getCanonicalNameForWebAppTmpDir(context));
+ File tmpDirAsFile = tmpDir.toFile();
+ tmpDirAsFile.deleteOnExit();
+ context.setTempDirectory(tmpDirAsFile);
}
@@ -522,11 +520,7 @@ public class WebInfConfiguration extends AbstractConfiguration
else
{
//ensure file will always be unique by appending random digits
- tmpDir = File.createTempFile(temp, ".dir", parent);
- //delete the file that was created
- tmpDir.delete();
- //and make a directory of the same name
- tmpDir.mkdirs();
+ tmpDir = Files.createTempDirectory(parent.toPath(), temp).toFile();
}
configureTempDirectory(tmpDir, context);
--
2.23.0