[IO-712] SecurityExceptions are hidden instead of breaking the regular flow

• Type: Bug
• Status: Closed
• Priority: Critical
• Resolution: Not A Bug
• Affects Version/s: 2.8.0
• Component/s: Utilities
• Labels: Security SecurityManager
• Flags: Important
• Assignee: Unassigned
• Reporter: Boris Unckel
• Created: 29/Jan/21 11:26
• Updated: 06/Feb/22 21:59
• Resolved: 06/Feb/22 21:59

Description

Several points in the code hide SecurityException. These must always break the regular control flow, if you're not the SecurityManager.

UseCase A: One wants to configure the SecurityManager and grant permissions. Part of the application is to delete a file. If the permission is missing, cleaning does not work. The missing exception does not allow to recognize that.
UseCase B: One has activated the SecurityManager. An attacker abuses the relevant method. The missing SecurityException hides this attempt, ones IDS can't alarm.
UseCase C: One utilizes the SecurityManager to test the system, to ensure every property (like file location) is set properly. The missing SecurityException does not support this UseCase.

Issue Links

• links to: https://github.com/apache/commons-io/pull/197